NotificationService implementations (eg SlackService, PagerDutyService, ..) are buggy.
They fail the communication service if the secure_* variant of the settings are put in the cluster state as opposed to inside the keystore, as documented https://www.elastic.co/guide/en/elastic-stack-overview/6.3/actions-pagerduty.html#configuring-pagerduty (for eg).
The normal behavior should be to simply ignore the setting when in the cluster state. In this case the service would fail to start and complain that the setting is not found in the keystore.