You should probably make it clear during server creation that if you have added SSH keys on the web site, they will be injected into ~root/authorized_keys in the image, if that's what you do. Linode, for example, lets you add SSH keys on their web site, but that's only to access your VM's console.