The Func Puppet module manages all aspects of Func. It can deploy Func on all managed nodes and sign all certificates exchanged between the minion and the certmaster (often also the Func overlord).

The trust of certificates exchanged is implicit, as only certificates exchanged by nodes managed through the Puppet master will be signed automatically. The trust can be implicit, since you trust the nodes including the Func module already, through Puppet.