Ways to manage passwd/shadow files?

[Spam Collector]

What's the best way to use cfengine to manage /etc/passwd and /etc/shadow?
Managing the entire file as a copy would be easy enough, but how can you
just manage a chunk of it?  Using edifiles to control a block would have
the desired result, except that AFAIK you can't have comment lines in
those files (the ### BEGIN and ### END lines I use to manage blocks in
other config files).  Also, I wouldn't want my shadow passwords to
be copied everywhere in the config.
   I suppose I could use two bogus usernames to define my block and use
some of the *File* editfile commands in conjunction with a copy, but
that just seems like a hack.  Is there a better way to accomplish this?

Frank