You didn't mention anything about how the web server knows if the other end of the connection is this user-hostile browser or a python/javascript bot with a spoofed user agent.
This would always need some backup solution and now you're back on square one.
Edit: also you'd need accessibility, so a glove is out. And how do you handle game consoles? Voice assistants like Siri or Alexa?