Inject the users public key in as root and have pubkey only logins for root.

Now you are both secure and convenient.