Validation still happens in zones set as insecure, sometimes

While fixing Deckard tests for !1030 (merged) I encountered this weird behavior:

Even with trust_anchors.set_insecure({"net.",}) in configuration Resolver still tries to validate records for k.root-server.net.

Attached are the artifacts from the Deckard run (including a rpl file and log). lidovky_insecure_net.zip

This is probably related to #626.