To all the commenters telling me that cloud-init is not a credential provisioning system, the docs do not make that clear! They talk about provisioning and SSH keys too! So I looked and... then it became clear that that was not really the case, so I expressed an opinion with substantive information that might help someone -if anyone happens upon my comment who contributes or would contribute to clouid-init- improve it.