Clear fallback level for non-DANE destinations.

Since the effective policy is "may", there is no need for
a fallback setting.

Add comment text about fallback from "encrypt" with unusable TLSA
RRs.