Similar to the recommendations to use a YubiKey/hardware token, SeKey on a Mac lets you use a key generated in the Secure Enclave in an unexportable form (https://github.com/sekey/sekey)
Not criticizing, just genuinely interested in how to best manage keys.
I find web services to be a huge pain, though: Obviously most don't offer any kind of 2FA, or maybe Google Authenticator or SMS at best (which means those websites must be so bad that people don't login to it on their phone?). But even those who do "proper" 2FA often will only allow a single U2F token - and enforce GA, SMS or a secondary email as fallback.
(Putting this rant here so maybe a webdev or even two do it better the next time they do some auth stuff ;-))
You should always have keys per device (as has been discussed in other comments here). So if you have >1 device, you'll automatically have backups.
> If so, how do you protect that ?
While it may seem bad to have some keys less securely protected than others, the ability to revoke a single device means that using Yubikey / Secure Enclave / whatever on one device is still better than using them on none.