Hmm, not sure that allowing debian-security-support in testing is a good idea. What would happen with upgrades from stable to testing in such case? I think it would also fail for the same reason.
Maybe we should really make the error not to be fatal in version 2019.02.02~deb9u2 in stretch? Thanks.