Needed for an empty non-terminal test.
Rework NSEC logic.
Handle empty non-terminal DNSSEC