I would also think about replacing ssh host key regeneration with an ssl ca that is centrally managed