The play cannot start because one of the key contains an invalid trusted device list (TDL).

Request a key with a valid or a generic TDL. Note the ICMP is a permanently married system and doesn't process the TDL but it needs to check the TDL is properly formatted. For the same reason, the ICMP only provides one certificate while separate IMB - ICP configurations (non-permanently married) would provide 2 distinct certificates.