I have three: 1) local usage 2) local backup key 3) remote backup key

every few months I swap 2 and 3, and re-enroll any missing (kept track of with a spreadsheet)

quite annoying, offline enrollment would be considerably better