So if the dn set is empty, we just silently fall out. Is that because we expect it to be empty only for the root? In that case we should assert as much.