And hope it's a protocol 2 key, I really can't think of anything else
outside of asking the user which key to serve at image creation time to
this one ssh key problem

This might not be the best thing to do. The other option is to get a host
key from the user and check based off of that. That is just more process
though.

Some of these AMIs request only the first ssh key. Which means we never to
load in the entire set. Atleast this will force some bare minimum access.
Maybe its ridiculous to assume the first pubkey is the "important" one

..ish.