drop pdnssec calls as we are using BIND for now
serious graphviz improvements
generate both NSEC and NSEC3 zones