the iked daemon must run as root. (running as a user immediately fails with "you must be root to run this program")   since it's a VPN client, I assume it needs lower-level permissions to manage the network (tuntap does as well) - will add the :startup option...  (the client/manager apps run in userspace though)