My way of thinking:
putting the real default values into the module, init.pp so to speak.
Hiera can then be used to set your site/hub defaults as needed.

But on the other side, you don't see the default values when logged on to a Puppet node... I'll put the default values back into sshd_config.