Thanks for your work securing campaigns! I forwarded your post to my team because a major goal of ours is to be useful for this purpose.
Advanced Protection has improved a lot since early days. For example it works with Apple's native Mail, Contacts and Calendar apps on iOS.
Advanced Protection doesn't require any specific model of security key. The blue YubiKeys work just fine and even Touch ID is supported (as a U2F key).
Multiple backup keys are supported. And the same key can be used on multiple accounts.
Breaking or losing a key doesn't cause an immediate lockout. A key is required at first sign in on a new device or browser session but not thereafter. I don't even carry a key most of the time.
I'm sure there's more we could do to build great account security for campaigns. Please keep the feedback coming!