OP_CHECKSHRINCS uses one public key with two ways to spend.
The first path keeps signatures small by having the device track how many times it has signed.
The second path doesn't track anything and is always available as a safety net. If your device is lost or replaced, you restore with your recovery phrase and fall back to that second path.
It's more expensive to spend from, but you are never locked out. This is how SHRINCS works.