The play cannot start because one of the key does not contain a trusted device list (TDL). The key should at least reference a generic TDL.

Request a key with a valid or a generic TDL. Note the ICMP is a permanently married system and doesn't process the TDL but it needs to check the TDL is properly formatted. For the same reason, the ICMP only provides one certificate while separate IMB - ICP configurations (non-permanently married) would provide 2 distinct certificates.