managing ssh and gpg keys in home dirs

[Kurt Lieber]

I'd like to use cfengine to help manage home directories; specifically
users' ssh and gpg keys.  The goal is to maintain a master repository so we
can quickly deploy a new server if needed (or if a user torches their home
dir, etc.).  I've got the copying back and forth figured out -- that part
is relatively easy.  However, there are two issues that have me stumped:

1.  For the master repository, I'd like to keep all the files owned by
root.root and chmodded to 700. Is there a way I can easily set file
ownership on files that get copied out to a production server?  Something
like "chown -R $user.$group /home/$user" except in cfengine terms?

2.  When a new user gets created, is there a way cfengine can automatically
detect that and add the necessary files to its master repository?  Perhaps
continually monitoring /home/ and, when it discovers new directories, copy
them over to /var/cfengine/masterfiles/home/?

Thanks.

--kurt