More text on why signing NXDOMAIN responses doesn't work