Ensure that a too high NSEC3 iteration count leads to result INSECURE
Tests for ECDSA keys if ECC is available on the JVM
Coverage tests for mismatching NSEC3s

- Different hash algorithms
- One NSEC3 having a salt and another not having one
- Different salt in multiple NSEC3s
Allow trust anchors with different algorithms for the same domain
Prevent DS downgrade attacks
Refuse DNAME wildcards according to RFC4592
Better parsing of rpl server config options
Treat off-tree signatures as bogus
Deny overreaching (out-of-zone) NSECs
Fixup RRset signature order
YXDOMAIN from head resolver is SERVFAIL on failure
Test for mixed NSEC/NSEC3 and unknown hash alg
Sanitize rpl input from iterative Unbound stuff