AXFR-out can handle secure and insecure NSEC3 optout delegations