Wouldn't a OTP scheme like OPIE be able to do this decently? My own computers do not permit root login via ssh, but still it'd be more or less a trivial matter to set up a local account for your "SSH buddy", and then over the phone give him the next OTP in sequence for the root account or so for a successful su - -c halt.