dnssec: fix closest encloser and wildcard nsec3 generation

This was not working at all.