Handle the RRSIG direct query in a special fashion.
Handle missing DS record at apex in DNSSEC.
Clarify.