Alternatively don't use u2f on your root account, just on a standard user. And never touch the root account for anything other than provisioning users.
Or use two security keys, one on your root user and another for your own personal IAM user, but you're right, don't use your root user for everyday tasks.