partial NSEC3 support, can correctly declare some subtrees bogus or insecure