I'm not perfectly fluent in the U2F/WA protocol but shouldn't it be possible to have two devices but one is programmed to only accept registration and not allow normal operation?

That way you could put the fully functional one into a bank deposit and use the other to register that key...