to do this, I extended getDNSSECRRset(name) further: it now takes 'covering'
parameter, depending on whether the requested NSEC is for the exact name
or the covering ("previous") name.  In the latter case it does the same
thing as findNSECCover() (which will be merged to getDNSSECRRset later).