606 / 621

Implementation of 606. Should fix 621 too :)

Implementation is for pdnssec only and uses the awesome replaceRRset