For physical keys I don't need to ask permission to be able to make a second or third copy.

You don't need to ask permission to buy another key then register it to your self-hosted service.

In fact if you have the technical skills to make your own physical key and respect standards, e.g U2F, you don't even need to buy one and it will work with existing devices and services. I can recommend the Precursor for an interesting exploration of that from a verifiable software/hardware perspective.