In case of DS query resolver fails to set AD bit in secured answer which contains proof of DS non-existance

Can be reproduced on master 3ab77332

; <<>> DiG 9.10.3-P4-Ubuntu <<>> DS www.nic.cz. @127.0.0.1 -p 53000 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21713
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;www.nic.cz.			IN	DS

;; AUTHORITY SECTION:
nic.cz.			1800	IN	SOA	a.ns.nic.cz. hostmaster.nic.cz. 1488365402 10800 3600 1209600 7200
nic.cz.			1800	IN	RRSIG	SOA 13 2 1800 20170314135007 20170301095002 16836 nic.cz. HmmtL7DYa1bIzNPCo9Yg0OIqt9/Rfi17cEdP/cuGXNHrPRcZC8bI5LlH q46ttGn8kJiTrL2k0Uo6iL0jhKwPFQ==
4b8t67cjp48mq1mhaktnc84pe31p5vsr.nic.cz. 7200 IN NSEC3 1 0 10 BE12622C87BA4DD9 4CRQD6EI4PBSM4RP58B9CTDCD16H8JIF A AAAA RRSIG
4b8t67cjp48mq1mhaktnc84pe31p5vsr.nic.cz. 7200 IN RRSIG NSEC3 13 3 7200 20170314204546 20170301095002 16836 nic.cz. GeCUr3v/SLUtQXPjBozIREOOSadBXQVjJ1Xs+q7mMzyfwQE+KxjzKyJB kXW0NM1JvSYjw4HY3CX4Jwr5GZeQXA==

;; Query time: 300 msec
;; SERVER: 127.0.0.1#53000(127.0.0.1)
;; WHEN: Wed Mar 01 13:26:11 CET 2017
;; MSG SIZE  rcvd: 415

at that time Google PDNS returns

; <<>> DiG 9.10.3-P4-Ubuntu <<>> DS www.nic.cz. @8.8.8.8 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45952
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1