The right questions. The ability to set up an alternate key in advance is functionally similar to being able to make a backup.

If I had my 'druthers:

1. You can register multiple keys, such as for different devices. Like 5-10, not two.

2. There are two categories of keys: "Regular" and "Backup/Recovery".

3. Attempting to use a Backup Recovery key prompts to user to confirm that they want to discard all regular keys and promote the backup key(s) to the new regular.

In this way, a compromised backup key can't be used secretively.