In some cases, NSEC3 records were generated for empty non-terminals
that were subsequently deleted after applying the DNSSEC changeset.

refs #210