The services I interact with that support WebAuthn usually only allow you to register one key. Backup and recovery is a confusing puzzle for most of these services.
"Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Relying Parties SHOULD make use of the excludeCredentials and user.id options to ensure that these different credentials are bound to different authenticators."
One of the implications here being that you have zero available authenticators if your main authenticator breaks.
they do know about it (I had a friend who was a PM there), but it's low priority...