negative trust anchor does not prevent NXDOMAIN from aggressive cache
Right now aggressive cache masks "grafted" domains, e.g. fake TLDs, even if these are listed as negative trust anchors.
This is unexpected behavior and forces users to use
NO_CACHE which is not optimal. In future we should exempt NTAs from aggressive cache.