Hi Sergio, thank you for discovering this. Your proposed change has been tested and will be included in the next upload to Sid and subsequently the backported packages as well.
At the current time I see no need to backport this fix to the version 7.4.4 in Stretch, because the admin can easily fix this himself, by either making the TLS key owned by bacula instead of root or creating an override file for systemd to add the supplementary group. Grüße, Sven.
signature.asc
Description: OpenPGP digital signature

