clarify DNSSEC a bit