Let's *disable* ssh.service to make sure it doesn't start too soon, and modify the rpi-generate-ssh-host-keys.service unit (that triggers the generation during the first boot) to enable+start ssh.service when everything is ready. See: https://salsa.debian.org/raspi-team/image-specs/-/issues/72