[dnssec] issue resolving unsigned child zone using DLV

[Florian Weimer]

* Shane W.:

>> There should be a signed NSEC record showing that the delegation is,
>> indeed, unsigned.
>
> Well we're using nsec3 if that matters but if it's not
> being signed correctly, is that likely a bug with how we're
> calling dnssec-signzone?

Ah, in that case, you probably haven't upgraded some of the
authoritative servers to BIND 9.6.