A similar question was asked in http://stackoverflow.com/questions/1635963/open-source-and-how-it-works-for-secure-projects
As this is really an integration/deployment issue, you might consider using a lookup function for sensitive data.
By using keywords to identify your data and keeping separate tables in development, staging and production, you can still run tests against this part of the code, while protecting the sensitive detail.
Examples: Java getProperty() or Puppet extlookup()
Update: See also this Encrypted Yaml Hiera extension. Hiera is the (now standard) successor for extlookup() in Puppet.
You will still require a place where these keys can be decrypted without an operator present, so the Puppet master will need to know those keys. Because eyaml uses asymmetric encryption there is no need for sharing keys. You do need proper controls in place for access to the Puppet master, but that's nothing new.