Sometimes secure and inconvenient mean the same thing I guess! In any case, the user module should itself generate the key or they should build the feature into ansible-vault. I stumbled on the instructions provided on the Ansible website. There were no clear examples of setting a default password on the Ansible user module page.