both `dnssec-plug` and `dane-plug` shouldn't fallback to root servers
I use plugins along with Unbound as my system resolver.
Going to https://bad-sig.dane.verisignlabs.com/ will first try to resolve it through set resolver, and if it fails, it tries again by connecting to root NS (root-servers.net)
There should be option to disable the extension, to use other than set resolver (then it can be used to test system resolver settings)
Issue exists in both binaries (dnssec-plug and dane-plug)
My system is Chrome Canary (version 40), OSX 10.9.5