First enroll one with the option Allow signup without keys enabled, then disable that option and enroll a second one, or just change the option with any enrolled already