After some further discussion I think it's OK to expect that an image that has cloud-init will regenerate and remove ssh keys (on new instance) this is default cloud-init behavior.
I do think we should Conflict, but I also understand not wanting to change systems which have ssh-keygen which is currently running to a state where it's not run and users being unaware that cloud-init was handling that for them.
After some further discussion I think it's OK to expect that an image that has cloud-init will regenerate and remove ssh keys (on new instance) this is default cloud-init behavior.
I do think we should Conflict, but I also understand not wanting to change systems which have ssh-keygen which is currently running to a state where it's not run and users being unaware that cloud-init was handling that for them.