DNSSEC checker

A signed zone is only protected if the parent points at the right key and every signature still verifies. The check that settles it is asking the resolver twice — once letting it validate, once telling it not to.