Don't silently hide failures, barf on startup. Also add more integration tests that should catch some of these things.
This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies.