My limited understanding is that the key is on their phone (let's say it's a Google key, on an Android phone). When their phone gets lost, stolen, or breaks, are they screwed? This worries me because the chances of the phone being lost is high.
https://utcc.utoronto.ca/~cks/space/blog/sysadmin/YubikeyMos...
You may be thinking of "passkeys" and while a security key can be a form of passkeys, the ones generated for your mum will be on her device, yes.
A passkey is a shortcut, for now. Relying on a passkey being in place is another good way to forget your password. ;-)
That puts a lot of burden on users though.
Maybe start a pilot automated service run by Google or Microsoft or whoever where backup codes are securely sent to local credit unions and it's all almost transparent to the user. They just need to either pick up the code at the credit union and put it in their safety deposit box or approve that last step.
I'm not upset at all about banking working with private entities or any of the past with banks. I'm mostly upset because some of these ideas are good, you know? Maybe not this, but some. For a short while longer.
If you do go with a security key it’s typically recommended to have at least 2 so that if one dies or is lost both have the same level of access. So long as you add them both/all to every account you need to access.