Currently the API allows for creating SSH keypairs, and specifying keypairs to use when deploying a VM (if the correct script is installed in the template).
I would suggest adding a section in the UI (perhaps as a drop down option in the instances menu) to create SSH keypairs. I would then suggest adding an option in the Instance Wizard to select a keypair to inject into the instance upon creation.
It may also be worth adding a button to the instance menu to inject a new keypair upon reboot (like we have for password resets now). This could be enabled/disabled with a template flag (e.g., "SSH Key Enabled," like the "Password Enabled" flag we have now)