AXFR-in can handle secure and insecure NSEC3 optout delegations