After successfully setting up SSH Key Authentication and disabling password access to my server, I can still log in as either 'newuser' or root using DigitalOcean's console access. Is this normal? It seems very risky.
The console of your droplet is the virtual server equivalent of being directly attached to the server's physical keyboard and monitor ports - it is not an SSH interface.
This tutorial describes its use: