More and more stuff for NSEC

Add 4 sorted lists so we can keep track of all the labels in
a sorted manor.
Only perform these action when DNSSEC is enabled
Make all the members private
Revert "Make all the members private"

This reverts commit 28fc12969b55d355350560b0abfbc95b3235503b.
update TODO
Only remove when a service did exist
More NSEC work