Support for NSEC3 opt-out
Currently, NSEC3 opt-out is not supported by zone signing. There is also no way to set the flag, as the flag in NSEC3PARAM has to be zero. The support can be added with the new DNSSEC library - the flag will be part of the KASP settings.
Note: Bind allows setting of the flag via DDNS. NSEC3PARAM with opt-out enabled is written as a private RR type, which is used to control the signing. Final NSEC3PARAM in the zone has the flag cleared.