I don't really agree with this one.. I think the user would expect anything wrapped in ENC[] to do its job, regardless of where it was.. and since it's already coded, I think it's more work to take it out. I'll try and clean up the readability of the code however. 

I might for example have an ftp string defined:

ftp_site: ftp://user:ENC[.....]@host/public/, which is useful to have in one property rather than three... so having mixed plaintext and encrypted text I think is a reasonably straightforward

I'd also eventually like to be able to take a hiera_file file resource as a source for eyaml, but thats future work - as for me all environment stuff belongs in hiera, not in modules, and sometimes your source config files are just wildly different, but should also contain lots of encrypted information.