I hadn't spotted the loop.

That is a complex use case and my suggestion would be to drop support for it anyway - it feels over-complex for a very corner case.  If someone wants to do that then they should probably do this in their eyaml:
```super_secure_pass1: ENC[PKCS7,......]
super_secure_pass2: ENC[GPG,......]
```
and then combine them in their puppet.