First, I'd like to say that the difference between "insightful" and "paranoid" is only visible in hindsight.

Next, I'd like to say that I've been extremely happy running Mobile One Time Passwords on my cell phone: http://motp.sourceforge.net/ and mod_authn_otp: http://code.google.com/p/mod-authn-otp/ on the web server.

Coupled with a .htaccess file in wp-admin, and fail2ban to firewall repeated password failures, means that nobody is getting in unless they have both your cell phone and your PIN.

This is world-class security for zero cost. Both projects are covered by the GPL and are completely free.