implement bits of +do auth querying
oneshot validator, checks RRSIG A against DNSKEY, no chain
oneshot now validates various valid things, and rejects www.dnssec-failed.org. Unsure whether we are doing KSK/ZSK splits correctly.
now only returns DS-checked DNSKEY, exposing that we indeed skipped part of the chain
now validates full chain (DS/KSK/ZSK), terrible recursion length for dnssec-failed.org
log outgoing queries
initial validator design doc
clarify
partial implementation of topdown iterator/validator
doc update
nit
now validates DS/DNSKEY chain down from root to target - ignores NSECs
snapshot
partial NSEC3 support, can correctly declare some subtrees bogus or insecure