This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies.
We don't need to network to do tests, we up enough local servers to we don't need to forward to,s say 8.8.8.8