An attacker's zone can respond with an RRSIG with fewer labels
than the zone it's in, causing named to produce a wildcard name
shorter than the attacker's zone — resulting in cache poisoning.
Requires synth-from-dnssec yes (which IS the default).