The default cloud-init configuration in cloud-init 0.6.2 and newer included \ssh_deletekeys: 0\ disabling cloud-init's deletion of ssh host keys. In some environments this could lead to instances created by cloning a golden master or template system sharing ssh host keys and being able to impersonate one another or conduct man-in-the-middle attacks.