They don't, but that's a non-compliance. The WebAuthn (WebAuthn is the standard way to support FIDO in a browser) specification explicitly tells Relying Parties (which is what AWS are here) that they need to allow users to enrol more than one key.

The whole API design incorporates this thinking. The API call to tell a browser "Hey I want to enrol a Security Key" navigator.credentials.create() takes an array as a parameter with IDs for keys you don't want to enrol because they enrolled already.

The call for "Hey, prove you still have that second factor" navigator.credentials.get() needs among many things an array again, this time for IDs for keys that you'd accept, and one reason that's needed is that other keys needn't bother doing anything as they can't help.

Yeah, but AWS is a bit, uhh... just because AWS screws it up doesn't mean everyone else will.

That probably came across like speculation based on AWS's reputation, but it's also my actual experience after going on a U2F spree. Out of maybe 7 or 8 accounts, AWS was the only one that didn't support a backup key. Point is: I don't think it spells doom for U2F. Wasn't it just a few days ago that AWS was allowing password resets that couldn't be used for login because of validation? I don't remember the service, just that I saw it on HN.

You can make it work by creating multiple IAM users, for different keys. Just make sure they have billing and full admin access. Still doesn't help for root 2fa, but just give that a random 32 char password and stick that in a safe deposit box or something.