This allows the test to work with more adventurous DNS resolvers which
search for missing AAAA records on NS names.

We also avoid resigning the whole test by selectively turning off
validation for some subtrees.

This however triggers a probable bug in Knot Resolver which tries to
validate names from zones that are set as insecure. We therefore use
built-in root hints which is fragile but works for now. 🤷