The default set is 'HIGH:!aNULL:!MD5', set in manifests/params.pp in puppetlabs-operations/puppet-nginx would probably be sufficient. I don't know whether or not people would want stronger cryptography to be used on their puppet communication.

The set defined in manifests/passenger.pp for the apache::vhost is "ALL:!ADH:!EXP:!LOW:+RC4:+HIGH:+MEDIUM:!SSLv2:+SSLv3:+TLSv1:+eNULL". It could be worth making it configurable for people who want greater control over these things.