Added reference to dnssec-loadkeys-interval
Clarify NSEC3 opt-out behavior