How to use private docker images with public AMIs(Amazon machine Images)

I have private docker hub images and ECR images.
I am tasked to create an AMI for public consumption.
That means that I don’t know which Amazon client accounts will be using the service in advance.

If I use ECR, it looks like I need to ship the AMI with my AWS credentials for easy updates(not safe).
Alternatively, I could remove the credentials, but the clients will need to set up their accounts(not desirable). It also means that I need to make ECR images publicly downloadable by anyone.

If I use private docker hub images, I will only need to ship the AMIs with access tokens. This looks more promising.

How have you solved this problem before?

Source: Docker Questions