Puppet Community

Hmm I did find this:  <https://support.puppet.com/hc/en-us/articles/13823637065239-Copy-hiera-eyaml-encryption-keys-from-the-primary-server-to-the-compliers-and-replica-in-Puppet-Enterprise|https://support.puppet.com/hc/en-us/articles/13823637065239-Copy-hiera-eyaml-encryptio[…]ry-server-to-the-compliers-and-replica-in-Puppet-Enterprise>

Yes, the compilers each need a copy of the key.

every system which uses your data and which compiles a catalog needs the keys. this might also affect your ci.