The trust anchor and keys are not changed in order not to disrupt packet
validation.

All RRSets in section must be signed properly. (Currently no checking for
non-authoritative RRSets is implemented.)

the resolution driver now correctly fetches keys,
and the zonecut lookup should find closest TA,
then the validation module should have all the
information needed for simple validation

the only flag supported now is the KR_REQ_DNSSEC,
which indicates that the caller wants a secure answer

this can coalesce sends/writes in future versions of libuv