When the ARES_FLAG_DNSSEC is specified, use the nameservers that are tagged as trusted.

The trusted nameservers are read from /etc/resolv.conf and the
'trusted-nameserver' option (which is a custom extension). Its syntax
is the same as the nameserver option.