The issue was reported by @slawek during 1.10 sanity checks. Source.
At least one Kea Control Agent in the demo should be configured to accept only TLS connections.