The autoinstalled Debian stable includes some host keys (DSA and RSA) built in 2005. This seems very dangerous. Perhaps the install script should be improved to build new ones as the install is done?

(Also, it is not updated to the latest security updates, however this is not so important - if the end user doesn't know how to apply security updates, their linode will quickly get out of date anyway; but not all end users know how to set up their SSH host keys as these are usually set up on first install during a standard distro install.)