negative trust anchor does not prevent NXDOMAIN from aggressive cache
Right now aggressive cache masks "grafted" domains, e.g. fake TLDs, even if these are listed as negative trust anchors.
This is unexpected behavior and forces users to use NO_CACHE
which is not optimal. In future we should exempt NTAs from aggressive cache.