Maybe I should just round-robin the off-site key. It's just tedious to keep track of what's been registered with which key and making sure they're all in sync. I really wish there were a secure way to simply have a key backup.
Not to mention, this is kind of expensive and also non-obvious as Yubikey primarily sells single keys. I'd love to see wider adoption, but can't see the general population putting up with this.
The disadvantage here is obviously it's just another password manager instead of taking full advantage of hardware tokens, but I want to be able to enroll passwords or tokens without the key present all the time. (Also, yubikeys have limited slots for keys)
Unless you need the GnuPG or SSH applets, I just use the $14 FIDO keys from Identiv. They are also NFC capable for my mobile devices also. I keep one at my office, one at home and carry one in my pack.
I too wish there were a way to keep them in sync or back them up.
Maybe a virtual FIDO key? https://github.com/bulwarkid/virtual-fido
Edit: also, if your house burns down, won’t you probably have your keys on you if you’re not home?
As for a fireproof safe, I do have one, but they're rated for X hours and degrade over time. I should probably get a new one.
Then a printed backup sheets like 1password somewhere offsite (still needs master password to be usable)
