dnssec/nsec: add a precaution when checking DS nodata

I just found it by accident when studying RFCs again.
Hmm, I'd like an operator for logical implication; I'm spoiled by Maths.
5 jobs from ds-nodata-nsec in 75 minutes and 16 seconds (queued for 3 seconds)
Status Job ID Name Coverage
  Build
canceled #72922
docker linux amd64
build:linux:amd64

passed #19403
docker linux amd64
build:linux:amd64

00:00:33

 
  Test
passed #19405
docker linux amd64
deckard:linux:amd64

00:00:31

passed #19406
docker linux amd64 allowed to fail
respdiff:linux:amd64

01:15:16

passed #19404
docker linux amd64
test:linux:amd64

00:00:21