Today, image created by imagefactory has to be sealed by providing the 'sealing' instructions as post commands.
However, virt-sysprep already supports sealing an image with various options [1](i.e. remove ssh keys, remove mac address).

imagefactory can support such functionality by extending the image definition template (or any other future representation) to include the operations to be invoked via virt-sysprep on the image. The 'sealing' should be executed as the final step of the image preparation.

[1] http://libguestfs.org/virt-sysprep.1.html#operations