NSEC: Test for NODATA when wildcard NSEC proves type or CNAME
Tests for NODATA when NSEC proves DS and fail when NSEC is from child
When NSEC(3) does not prove no DS treat not [IN]SECURE as BOGUS
Test NODATA when NSEC signature is bad or for different qname
Clear any potential AD flag on the incoming message
Ensure that injected test data is independent from the test itself