'rndc nta -d' ought to report 'validate-except'

We can use 'rndc secroots' to list the trust anchors and 'rndc nta -d' to list the negative trust anchors, but there seems to be no way to view the permanent NTA's that are set up by validate-except. This seems potentially misleading.