Remove checks for null keySets as the case can never exist

And even if it would occur due to changes one day, there would simply
be an NPE. This would be unexpected behavior but would not give a
wrong security status.
Clarify precedence in NSEC name error proofing
Add tests to ensure the validity of NSEC signatures and that wildcard
synthesis was performed using the correct wildcard.