ongoing stuff

The reverse is already in reverse, need to think how to handle this
neatly. Another issue is DNSSEC: the reverse will not be signed
unless there is another key in play.