propagate forced TLSA onto subdomains