Then that key can no longer be used. The solution to this resulting in being permanently locked out is to have more than n+1 redundancy in hardware, and ideally meatware too.

You need two; one stowed safely and only retrieved to enroll a new service, and one to use day-to-day.

enroll a new service? we are talking about gpg smartcard usage, for ssh - not u2f 2fa.

you don't need the physical key to "enroll", you just keep a copy of its pubkey.

the idea is to generate the key in the device, so it never leave the device, therefore you cannot store it somewhere else like another device.

So, the ideia is for you to have two devices, each with its own key, the first device you use daily and the second you use store in a safe location.

if your first device in daily use stop working or is lost you use the second device you have stored to login to your systems to remove the keys from the lost device and add the keys for a new device that replace it and then store the second device back in a safe location.

I have one key permanently in a usb port of each computer, and one on my keychain as a backup (which is also used for U2F and has lightning so works with my phone for 2FA), so five in total, each with their own RSA key for ssh.

If you use GPG and YubiKey approach, you can create the keys in offline computer, store them to YubiKey, and make paper copy of the private key. Also you probably shouldn't have only single way to access the remote computer, I still intend to store password for root that I never use.

I wrote about my endeavour with this approach just few days ago [1].

[1]: https://github.com/Ciantic/thoughts/blob/master/2021/yubikey...

You should totally disable password authentication for SSH.

You are right, but you can still use password for recovery purposes even if it's not used for SSH authentication.

Most VPS provides "web console" access. It connects like terminal, like Digital Ocean's web-console that doesn't require SSH access [1].

[1]: https://www.digitalocean.com/docs/droplets/resources/console...

I'm more worried about simply losing it. I travel a lot.

Just use multiple. That's what I do.

As backup you can also use OpenPGP cards which cost much less than a yubikey. Or a cheaper Fido2 token if you use Fido2 for SSH access (I don't yet but it's coming into vogue). An OpenPGP card will cost about a tenner, you'll need a card reader to use it but for backup purposes it's perfect.

Have a higher security fallback.