You could have a single soft-U2F vault that contains all your accounts, and secure that vault with your hardware tokens. Using something similar to LUKS (http://clemens.endorphin.org/TKS1-draft.pdf), you could allow multiple tokens to decrypt the vault without exposing the master key. The downside is that there’s no way to revoke access to the vault if a copy leaves your possession.