Those are the right questions: While I'd personally prefer full copy/import/export control, having the ability to set up an second key in advance is functionally-similar to having a backup of the first one. If I had my 'druthers:

1. All sites/services would allow the registration of 5 or more keys, which can be tracked/revoked separately. That way if one device is stolen, you can invalidate that key without affecting others.

2. There are two sets of keys: "Regular Use" and "Backup/Recovery".

3. Attempting to use a Backup/Recovery key prompts to user to confirm that they want to invalidate the Regular keys and promote the backup key(s) to the new regular. In this way, a compromised backup cannot be used in secret.

There’s FIDO CXF/CXP: https://fidoalliance.org/specs/cx/cxf-v1.0-ps-errata-2026030...

To my understanding both Apple Passwords and the Android equivalent allow you to export passkeys to a different app (password manager), but I haven’t tried it yet.

If anyone has direct experience I appreciate to know how it was.

From account security POV, it is better to disallow backup or export passkeys. Each device should get their unique key.

This would be quite bad from usability or privacy pov, I guess.

Also, can I add a backup key without having the private key with me? Ideally I would like to keep a master key in a vault, to recover compromised accounts and such, but requiring me to load the master key to create every account prevents truly secure storage.

> backup / export

Last I heard this was a major point of contention between two groups, and last I checked, both had extremely valid concerns.

> Multiple passkeys

I commonly have two software and two hardware keys registered per site.