We are taking about Puppet, not OpenSSL or GNU TLS, or even GPG/PGP etc. And also probably a one-off case when user wants some random string to be generated.