RFC #1: Renewal proxy for the VMs instead of a cert (pub,key)

This is a request for comments about the next generation security method in the Virtual Machines. The aim is to avoid the risk of put a private key certificate in the VMs, even when this keys are in private images or secured copy to a VMs. A more secure aproach would be to use a X509 temporal proxy, for the nature of such method the secure copy would be the method to put it in the VMs. The DIRAC proxy manager Agent could be used to renewal the VMs proxies when close to expire. The secure aproach is to put all the control of the renewal in the DIRAC server side, so a initially a ssh access is necesary to copy the proxy. Unfortunally this method is not allways suported by IaaS providers. Ideas ? Comments ?