In order to prevent passwords or keys being written to logs I have to use no_log, which means that all actions taken in that module/play aren't logged. Which if it fails becomes a nightmare to troubleshoot.
It would be beneficial to tag or provide a list of sensitive variables and have Ansible simply not write those values to log, possibly write the name of the variable or just write SENSITIVE to the logs.
This would allow us to log and troubleshoot complex actions, and be sure that the expected values aren't going to be written to disk or logs.