Our computers should have a specific port for a physical key which we would carry around in our keychain.
My understanding is that backup keys should not be identical for that reason. Let's you revoke and audit use.
As such, having a backup has to be accessible so that you can register it places. There are tricks, but they only work in certain scenarios. Mostly not in the fido use cases.
Proving your identity when you lost your proof of identity is still an unsolved problem if you ask me. At least in general, it seems that there is no one solution that works for everyone.
You can remove the PIN later. The hardware key can be set up to wipe the device after, say, 10 incorrect guesses.