Imagine you deploy Debian-based Xen VMs for customers. How would you hand it over to them with it in the most secure state possible, while keeping the system in a state the customers expect?
I don't like the idea of having the root account accessible via SSH without any IP restrictions - but it seems the most practical. I am personally in favour of, in our automated deployment process, generating SSH keys, creating a non-root user, disabling root logon and only permitting the non-root user to logon with their key - then telling the customer that they can change it how they see fit.
How about giving the key to the customer? Email?