Check and set Security=TypeNSEC

When signing with Sign() only a unsecured or a TypeNSEC zone can be
signed. An NSEC3 type zone must be signed with Sign3()
Update Sign and Sign3 documentation