I hadn't looked at my config in a while and you're absolutely right, running as root is a big warning flag. Just fixed it with the tincd "--user" flag. Created a new tinc user that owns all of /etc/tinc and set "--user=tinc" in /etc/default/tinc. Runs fine.