I've just researched this and it is true, that configuration leaked from the
build server's own configuration, which it's used during the build process
for the iso image.
The resolv.conf file is emptied in the clean-up process for the image, but
apparently recent versions of the avahi-daemon make a copy of that file when
installed, and those settings are used as a fallback from that point on.
Those servers should in any case be queried only if the nameserver set by
dhclient (the one the router suggests) fails to resolve the request.
I'm adding those files (/etc/resolvconf/resolv.conf.d/*) to the clean-up
process so newly produced images will not have that fallback. I'll be
spinning new images both for Trisquel and for the FSF membership card during
the weekend.
