I think a safer approach would be:

1. Change root password
2. Update Packages
3. Admin Account Setup
   1. Create New User
   2. Add new user to sudo group
   3. Test login and sudo
   4. Disable root login
   5. Test ssh configuration with sshd -T
4. SSH Key Setup
   1. Create SSH Key
   2. Install SSH Key for new user
   3. Test SSH Key authentication
   4. Disable password authentication
   5. Test ssh configuration with sshd -T
5. Restart sshd

This breaks up Disable root login & password authentication into separate steps because it is safer. Instead of a kill switch at the end, vulnerabilities are removed in a sequence. First, a user is created and login to the user with sudo is tested and verified working. Then root logins are disabled. Next, key setup is handled along with disabling password logins.