You have a button you can push (#3 in your list above). So this means you are well on your way. You would need to create(or have created for you) a password app, that would open on startup, and prompt you for your password. Of course entering a password using a keyboard isn't so great, but since you have a button, you can ask for a certain set of button pushes, in a certain order. (Whatever works well for you).
i.e. you spell 'cat' in morse code with your one button. Or whatever. The important thing is that it's something YOU can do, and is likely not anymore easily guessed/caught than someone shoulder surfing someone typing the password on the keyboard.
That said.. I want to point out, you mention this is because you are worried about your PA's that are helping you with things maybe taking liberties you don't want them to. If you don't trust your PA's I think you should work on getting their trust (and vice versa), or look into replacing them with people you trust. If you need help with advocacy around this, reach out to your local Independent Living Center.
What about two-factor authentication for sudo? I'd rather start my users off with sudo 2 factor auth, and grow them into two-factor auth for ssh and other stuff.
They are based in the UK, so you have to convert their pricing, but Their service has been fabulous. It's Zimbra. I eventually ended up moving to iCloud, with my new phone, I ended up losing some income streams, and wanted to cut down costs, but otherwise I'd still be with them. There is also 01.com, I used them some too, they are fine, if you need a US based provider.
