Thanks to Matthias Anfree for spotting this.

server=/example.com/<ip-of-server>

The rationale is that the chain-of-trust will not be complete to
private servers. If it was, it would not be necessary to access the
server direct.

Thanks to Michał Kępień for spotting this.

A zone which has at least one key with an algorithm we don't
support should be considered as insecure.

The list of exceptions to being able to locally answer
cached data for validated records when DNSSEC data is requested
was getting too long, so don't ever do that. This means
that the cache no longer has to hold RRSIGS and allows
us to lose lots of code. Note that cached validated
answers are still returned as long as do=0

Much gnarly special-case code removed and replaced with correct
general implementaion. Checking of zone-status moved to DNSSEC code,
where it should be, vastly simplifying query-forwarding code.

Thanks to Brian Carpenter and American Fuzzy Lop for finding the bug.