- Fix that for NSEC3 proofs the NSEC3 zone, as the b32.name is

checked to be the same as the signer name. Also RRSIGs are
  not considered valid when an NSEC3 is not b32.signerzone.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.