Fix nsec3 optout and don't sign  NS records in normal nsec3 mode