Usually you just use multiple keys - one USB-C in the MacBook, one tiny USB-A in the laptop and the built-in Titan key in the Pixel phone. You don't remove them.
This still mitigates the most common MITM-type attacks:
1. Attacker instigates login via fake portal.
2. Attacker fools you in to entering your 6-digit OTP.
3. Attacker intercepts your valid OTP, combines with your stolen password, logs in to real site.
This doesn’t work with a YubiKey or the equivalent because of the back-and-forward cryptographic signing. The request has to come from the website you’re logging in to, which it doesn’t in this scenario. It’s the weakness of part 2 above which we avoid here.
By using multiple keys, you are effectively removing that advantage: someone could have one of your devices (e.g. your laptop while you're out for lunch) and would be able to make use of your second factor without you knowing.
It would be nice if someone made a library that made incorporating Webauthn login into an app as simple as using django or Ruby on Rails or React to create a login form, so folks don't end up rolling their own and assuming that a user will have at most one yubikey.
Failing that, you could do what Zeit does and rely on email providers' support for Security Keys (login by email link only).
To name a few off the top of my head: Google, GitHub, Gitlab, Facebook, 1Password, etc.