I'm not sure how this would occur in xenial or yakkety.
cloud-init.service runs:
Before=sshd-keygen.service
Before=sshd.service
cloud-init.service is what runs the 'ssh' config module, which generates ssh host keys and disables root. And 'ssh' runs after 'user-groups', which sets the user-groups. So I'm not sure how this could happen. I'm not implying that it does not happen, but not sure how.
I'm not sure how this would occur in xenial or yakkety. sshd-keygen. service sshd.service
cloud-init.service runs:
Before=
Before=
cloud-init.service is what runs the 'ssh' config module, which generates ssh host keys and disables root. And 'ssh' runs after 'user-groups', which sets the user-groups. So I'm not sure how this could happen. I'm not implying that it does not happen, but not sure how.