fix verify-dnssec-zone output
introduce cleannsupdate