Only show the qname in the error message when a CNAME to NODATA failed
Detect insecure delegation in NSEC NODATA proof when qtype is DS
Don't validate queries with qtype=RRSIG on positive responses

Signatures don't have signatures themselves hence there is nothing to
validate.
Treat NSEC3 NODATA responses under opt-out as insecure