You still have to be able to prove to THOSE entities that you are who you say you are.

And I say that as someone who has a spare yubikey sitting in a safe deposit box.

Eventually, this would probably work out, but it still feels super shitty.

That's not a technical problem though. Going to a bank and saying "my house burned down, here's an affidavit or a notarised document stating I am who I say I am" is fairly likely 5o get you access again.

It's SUPPOSED to be a shitty/frustrating/annoying process, not easy. This is your "break glass in case of emergency" solution - you don't want to ever use it and you want it to be super hard for someone else to compromise it.

We have plenty of ways to make this easy but if all those avenues are blocked because of some black swan event, you need a backup - and that backup can't be too easy because then it invites attack.

do you clone the ubikey or enroll two different keys? i struggled to find providers who let you register a second key

I enrolled two different keys.

It's a pain in the butt, and it's very limiting because adding another secure service means going to the bank, so I try to limit the 2fa through yubikeys to things like my password manager, my keycloak instance, and other very important accounts.

My take is that 2fa is still not there yet, and I'm a little worried about the push for webauthn, since I foresee a lot of potentially lost accounts.

You can’t clone a yubikey

You can store keys generated off-device though. Depends which protocols you care about.