Recognize insecure NSEC3 name errors
Make NSEC3 utilities instanced in preparation to pass config data
Add default handling in determining support for DS algorithms
Make NSEC3 max iteration count configurable
Handle DS CNAMEs
Use the iteration count of the smallest configured key size
if the used key size is less than the smallest configured
Ignore wildcard checking when asking directly for the wildcard
Fix NSEC3 end of zone handling
Fix NSEC3 validation when query contains multiple wildcard expansions
Fix NSEC3 opt-out flag handling and associated unit tests
Validate NXDOMAIN in DS chasing just like in the NODATA case
Fix validation of wildcard NODATA ENT queries
Fix validation of query with multiple wildcard NSECs
Fix extraction of longest common domain name
Ignore sig-not-incepted test (the used zone is currently valid)
Avoid resource leak by closing the reader
Generate NSEC3 hash with DNSJAVAs public API
Fix NSEC NXDOMAIN proof when a zone has only one NSEC
Invert NSEC ENT check to match unbound
Simplify wildcard nodata proof