I used an sshkey resource like this:
and puppet created the /etc/ssh/ssh_known_hosts file with sensible contents,
but with mode 0600.
This file is supposed to be world readable. Of course I can use a file
resource to fix it, but I'd prefer it if puppet created it with a sensible mode.