various fixes for DNSSEC
add a management API to get the DS record that the user will have to set at his registrar
redo dnssec signing again, there was some other bug