add DNSSEC

* sign zones
* in a cron job, periodically re-sign zones because they expire (not tested)
let the user override some DNS records