enroll a new service? we are talking about gpg smartcard usage, for ssh - not u2f 2fa.

you don't need the physical key to "enroll", you just keep a copy of its pubkey.

the idea is to generate the key in the device, so it never leave the device, therefore you cannot store it somewhere else like another device.

So, the ideia is for you to have two devices, each with its own key, the first device you use daily and the second you use store in a safe location.

if your first device in daily use stop working or is lost you use the second device you have stored to login to your systems to remove the keys from the lost device and add the keys for a new device that replace it and then store the second device back in a safe location.