The trust anchor and keys are not changed in order not to disrupt packet
validation.

this is a saner default for large answers. instead of waiting for
probably lost/thrown away fragmented packet, do the query over TCP
instead

All RRSets in section must be signed properly. (Currently no checking for
non-authoritative RRSets is implemented.)

this fixes a problem when a module was removed, but pending
queries referenced it, causing a crash. usually when the
server was busy and a module was unloaded.
as we don’t need to copy layers at all, they’re just iterated
from the array of modules using a macro

no need to scramble queries satisfied from cache