Optionally only return REDACTED when decrypting pkcs7.

This is intended more as a feature request or request for comment than and actual pull request.

We use hiera with our PE installation, and the eyaml backend to encrypt all passwords and keys etc.
I'd like to be able to test a full set of production puppet code with production hiera data, minus the production passwords, without having to maintain another copy of the hiera data.


Thoughts?