[Puppet Users] Handling Sensitive Data

So we're looking at using Puppet. There are three things we're trying
to figure out how to manage -- SSL keys for the webservers, SSH keys
for the users, and the user's passwords (and specific /etc/shadow and /
etc/passwd for each box).

There's a ton of concerns with each one of these. Is there some place
with a good guide for doing all of this?

I came across a very old thread
http://groups.google.com/group/puppet-users/browse_thread/thread/da756bb067565ede
which implies you shouldn't put your sensitive data in the files
directory of the module. Is that still true?