Which don't? For all the big major ones I've used U2F with, they've supported multiple keys for a while (or since introduction). It's practically a requirement in case you lose a key..
To name a few off the top of my head: Google, GitHub, Gitlab, Facebook, 1Password, etc.
If that's the case, it must have changed at some point. Lastpass and Duo both support multiple U2F keys, and have for at least a couple of years. I have two keys registered with Duo for login at my school and also through Lastpass's non-Duo U2F support.
This is true, and it is dangerous (once the key fails, folks get locked out). I don't use security keys with such providers.
It would be nice if someone made a library that made incorporating Webauthn login into an app as simple as using django or Ruby on Rails or React to create a login form, so folks don't end up rolling their own and assuming that a user will have at most one yubikey.
Failing that, you could do what Zeit does and rely on email providers' support for Security Keys (login by email link only).
Usually you can use a TOTP backup method (Google Authenticator or similar). But don't actually use it. Just save the key to initialize it to a secure backup which can be accessed of your Yubikey is lost.
