It was probably me pointing this out that might have instigated the change.
If you look at the default openssh startup scripts, they will automatically generate new ssh keys if they are missing (“/usr/bin/ssh-keygen -A” does not overwrite any existing files, it exits cleanly without changing anything if they already exist). So all that really needed to happen was to delete the existing ssh keys (see first link above) before shutting down the fully tested OS to generate the primary image file.
# strace /usr/bin/ssh-keygen -A 2>&1 | tail -6
stat("/etc/ssh/ssh_host_rsa_key", {st_mode=S_IFREG|0600, st_size=1823, ...}) = 0
stat("/etc/ssh/ssh_host_dsa_key", {st_mode=S_IFREG|0600, st_size=1381, ...}) = 0
stat("/etc/ssh/ssh_host_ecdsa_key", {st_mode=S_IFREG|0600, st_size=505, ...}) = 0
stat("/etc/ssh/ssh_host_ed25519_key", {st_mode=S_IFREG|0600, st_size=399, ...}) = 0
exit_group(0) = ?
+++ exited with 0 +++
#