RRSIG and NSEC have to be together to deal with wildcards.