trust anchors: improvements around DNSKEY refusal

- also refuse revoked DNSKEY (explicitly configured as TA)
- typo in message that confused the meaning
- explicit message when DNSKEY is refused, even without --verbose
- code rewrite, handle flags in a better way than "== 257"
31 jobs for ta-noksk in 20 seconds (queued for 3 seconds)
Status Job ID Name Coverage
  Build
canceled #216734
amd64 linux docker
build:asan:linux:amd64

00:00:20

canceled #216733
amd64 linux docker
build:clang:linux:amd64

00:00:20

canceled #216732
amd64 linux docker
build:linux:amd64

00:00:20

canceled #216735
amd64 linux docker allowed to fail
srpm

00:00:20

 
  Test
canceled #216743
amd64 linux docker
deckard:linux:amd64

canceled #216751
privileged
distro:epel-7

canceled #216750
privileged
distro:fedora-29

canceled #216742
docker
doc

canceled #216740
dind
docker:build

canceled #216741
amd64 linux docker
installcheck:linux:amd64

canceled #216744
amd64 linux docker
installcheck:valgrind:linux:amd64

canceled #216737
docker
lint:c

canceled #216738
docker
lint:clang-scan-build

canceled #216736
docker
lint:lua

canceled #216745
docker
osx:build

canceled #216747
amd64 linux docker
pytests:lint

canceled #216748
amd64 linux docker
pytests:run

canceled #216749
amd64 linux docker
respdiff:iter:udp:linux:amd64

canceled #216739
amd64 linux docker
test:linux:amd64

canceled #216746
amd64 linux docker
test:linux:amd64:valgrind

 
  Extended
canceled #216752
amd64 linux docker
pytests:extended

canceled #216753
respdiff
respdiff:fwd-tls6-kresd.udp6

canceled #216754
respdiff
respdiff:fwd-udp6-kresd.udp6

canceled #216758
respdiff
respdiff:fwd-udp6-unbound.tcp6

canceled #216759
respdiff
respdiff:fwd-udp6-unbound.tls6

canceled #216757
respdiff
respdiff:fwd-udp6-unbound.udp6

canceled #216756
respdiff
respdiff:iter.tls6

canceled #216755
respdiff
respdiff:iter.udp6

canceled #216760
respdiff
resperf:fwd-tls6.udp-asan

canceled #216761
respdiff
resperf:fwd-udp6.udp-asan

canceled #216762
respdiff
resperf:iter.udp-asan