management: shell out external programs in a more secure way
re-do the backup script to use the duplicity program

Duplicity will manage the process of creating incremental backups for us.
Although duplicity can both encrypt & copy files to a remote host, I really
don't like PGP and so I don't want to use that.

Instead, we'll back up to a local directory unencrypted, then manually
encrypt the full & incremental backup files. Synchronizing the encrypted
backup directory to a remote host is a TODO.
increase duplicity's volume size from the default of 25MB to 100MB so we create fewer files
reorganize mail.sh a little
increase the postfix message size limit from 10MB to 128MB
update News Challenge status in README
remove obsoleted parts of setup/dns.sh

Now that dns_update is a part of the management daemon, we no
longer are using STORAGE_ROOT/dns for anything.
two more cases of shelling out external programs in a more secure way, see cecda9cec5643d7b89829d1663fcedea346eca23
write nsd.conf zones in a predictable order so that we don't keep rewriting it
add DNSSEC

* sign zones
* in a cron job, periodically re-sign zones because they expire (not tested)
let the user override some DNS records
dont create a separate zone for PUBLIC_HOSTNAME if it is a subdomain of another zone (hmm, this is a general principle that could apply to any two domains the box is serving)
use a better sort order for records in DNS zone files
nsd.conf wasn't properly using the signed zone files
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server

see #71
missing spaces in nsd.conf (has no effect but looks proper)
add DANE TLSA records to the PUBLIC_HOSTNAME's DNS

Postfix has a tls_security_level called "dane" which uses DNS-Based Authentication of Named Entities (DANE)
to require, if specified in the DNS of the MX host, an encrpyted connection with a known certificate.

This commit adds TLSA records.
use DANE when sending mail: if the recipient MX has a DANE TLSA record in DNS then Postfix will necessarily encrypt the mail in transport
add DNSSEC/DANE TLSA to the README
drop support for ADSP which since last November is no longer recommended per http://datatracker.ietf.org/doc/status-change-adsp-rfc5617-to-historic/