Agree about multi signature

You’re right: he can do all of the above

Edit:
If you only have one wallet then multi signature is the best option