Right now, the shipper output will use a simple if block to determine if it should use TLS or not:

	if s.config.TLS != nil && s.config.TLS.Enabled != nil && *s.config.TLS.Enabled {
		creds = credentials.NewTLS(tls.ToConfig())
		s.log.Debugf("beat is running with TLS")
	} else {
		creds = insecure.NewCredentials()
		s.log.Debugf("beat is running with insecure gRPC credentials")
	}

Problem is, right now, elastic-agent will never send an enabled: true field in the TLS setting, presumably as elastic-agent assumes we'll always be operating under TLS. We either need to remove the enabled field, or just set enabled: true in the default setting before we unpack the config.