For the reasons listed I got myself three Yubikey 5 NFC dongles and removed SMS wherever possible. Unfortunately the authentication landscape is still very fragmented. AWS root accounts for instance cannot be secured with multiple hardware keys, only one. So no backup. The only solution is to use virtual OTP and register the same OTP setup key on multiple hardware keys. Only Google seems to have the ability to register as many keys as you want.