dnssec/nsec: add a precaution when checking DS nodata

I just found it by accident when studying RFCs again.
Hmm, I'd like an operator for logical implication; I'm spoiled by Maths.