Only run DNSSEC tests if there is a DS record in the parent.
Make dnssec10 conform better to spec.