Nit changes for version 4

1. Swap NSEC3 rr 2 and 3 in picture for bit more clarity
2. Principles, not requirements
3. Missing NS RR in signed zone example