CipherSuites: Using 'Absent' for named CipherSuites on default installations does not work.

We were considering to use the 'CipherSuites' resource to remove unwanted ciphersuites due to regulatory requirements.
Unfortunately, we ran into some issues.

Using 'Absent' for named CipherSuites on a default Windows installation does not work for Windows installations where CipherSuites have not been previously configured.
I believe it is caused by the registry key HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002:Functions is non-existent when the OS is in default configuration.

Registry:

DSC verbose output:

Since the registry property does not exist the TestScript will not return $False, as the unwanted cipersuites are not present.

I was thinking the Get-TlsCipherSuite, Disable-TlsCipherSuite, and Enable-TlsCipherSuite commands should work better than editing the registry.
But these commandlets are not compatible with Windows Server 2012 R2 and older, albeit that should not be the worst issue after October 10th.

Start by reproducing the CipherSuites resource behavior with Absent on a default Windows installation, focusing on the TestScript and the missing HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002:Functions value. Compare the result with Get-TlsCipherSuite, Disable-TlsCipherSuite, and Enable-TlsCipherSuite, including compatibility with Windows Server 2012 R2 and older; done means unwanted named cipher suites are handled correctly from the default state.