Minds are like parachutes, just because you have lost yours doesn't mean you borrow mine...
I love discussions around security, everyone thinks their way is the only way. Here is what you do, take a step back, look at your infrastructure, consider access points, and then build a model that provides you enough security so you don't really have to worry too much about it.
That being said, my opinion below:
logging in as root frankly, stupid. There is just no reason to do it... so don't do it. For users with sufficient privileges to sudo to root, ensure your system is setup appropriately. Password Authentication, disable it, use SSH Keys only.
From trusted hosts, a limited number of /32 address logging in as your user account should not require anything more than your ssh key... from untrusted hosts, use two-factor authentication. Username/Password... + 6-8 changing number every 30 seconds...
NOTE: This configuration can be accomplished by setting in sshd_config:
Check out Google-Authenticator, its super easy to setup and configure, and does the job just fine. Its just like RSA or any other two factor setup, Google has an app for android and the iphone, so is pretty and easy tot configure. And when connection from untrusted hosts, passwords will be allowed if two factor auth is configured properly.
Carry around your password protect private sshkey on a usb thumb drive... SRSLY? Again, perhaps the guy as a specific need for such a ridiculously high security posture, most likely its overkill... The best security needs to be balanced, with functionality against annoyance...
my .02 cents