It would indeed be nice if you could "cross sign", CA style, a new yubikey with an old one, and that would somehow get passed along to the various services.

I have not thought about the various attack vectors that this may or may not enable though.