There are multiple answers that effectively say that ldap should be used instead of puppet for managing actual users. I'm inclined to agree based on a scaling perspective. Onboarding new staff members should be done by support teams, not by sysadmins adding new user resources.
However, managing ssh keys and authorized keys (along with sudo access and user config files) seems like a job perfect for puppet.
What is the standard way of managing keys and config per user? Can puppet augment ldap here? What happens if an employee turns rogue and we need to revoke their key from 1000 different authorized_keys files?