validate: various failures on 1.2.6 not related to forwarding
This seems independent of forwarding mode, and it fails on 1.2.6 as well. Example log:
[plan] plan 'v1.pcextreme.nl.' type 'DNSKEY' [iter] 'v1.pcextreme.nl.' type 'DNSKEY' id was assigned, parent id 37659 [resl] => querying: '220.127.116.11' score: 10 zone cut: 'v1.pcextreme.nl.' m12n: 'v1.PcExtrEME.nL.' type: 'DNSKEY' proto: 'udp' [iter] <= rcode: NOERROR [vldr] <= bad keys, broken trust chain
Other resolvers find the domain OK, including dnsviz, unbound and google.
EDIT: this particular name requires GOST for DS, and it's now correctly downgraded to insecure since !333 (merged) (and thus v1.3.2).