case.

the point of the test more accurately.

lines.

added some more comments.

updating the implementation.

added a couple of more related tests.

in the implementation.

dsBelowDelegation is disabled for now.

now that we have multiple test delegations, it would make sense to introduce
some generalization.

(A DS normally doesn't exist there.)

They might fail when it is implemented, the RRSigs and other details
might need some correction then.

addNXRRsetDenial() -> addNXRRsetProof()

also added a few comments to test data

When DNSSEC is requested, and the DS exists

the tentative attempt of returning NSEC3 RRsets in negative cases were
canceled, and updated the doxygen doc accordingly.

NSEC3 RRset for some types of negative responses.  (tentatively) added meta
tests to check this behavior, too.

rrset argument as a hint.

also extracted main findNSEC3() logic into a separate thread.

while doing so, revisisted the interface and the method now returns both
the closest enclosure proof and next closer proof in a single call.

to make it compile.

       or NXRRSET of wildcard expansion.