Problem was the function is copied from another one which
always decrements the arcount and trims the TSIG RR. But with
aggregated responses, this should be stripped not from first,
but from the packet actually containing the TSIG.