Please mask the tcb USE flag of sys-apps/shadow. It's not really ready, and it's still not obvious whether sys-auth/tcb is going to be supported on Gentoo.
Fixed, OK-ed by vapier on irc.