Though the stealth primary solution involves more moving pieces, and introduces zone transfers, which are more complex than provisioning via puppet, I've had no noticeable issues.

I say "noticeable issues", because although my DNS is monitored, the monitoring isn't granular enough to detect sub-minute outages, for example.

Did you have any issues in particular with the stealth primary solution?