It's three months to become aware of the problem, and maybe migrate. If you cannot complete the migration in the window you can opt into the deprecation trial and you'll have until around August.

Especially not across the Holiday period.

It's not, but as someone who has to deal with multi-year depreciations, setting the expectation that 3/4 month depreciations are something you'll have to deal with, is probably healthier for the ecosystem as a whole. It sets up positive incentives around automating testing and deployments. Anything that's valuable enough that you'd use u2f to auth to needs to be in this mode for general security updates regardless. Granted, moving to a new API is almost certainly more work than a normal security upgrade, but the point is that these types of websites are not something that you can set and forget. They need dedicated, ongoing maintenance.