this change should unbreak the NSEC3 regression tests, by bringing the HEAD bindbackend in line with what the 3.3.1 powerdns expects.