+TODO
+
+* Complete CNAME response validation code.
+
+ This differs from the original Unbound code in that it can only
+ validate CNAME/DNAME chains as long as we have the exact keys for
+ each element of the chain. The Unbound (java) version solved this
+ by requerying for each element of the CNAME chain and validating
+ each element independently (that is, it could construct a chain of
+ trust to each link separately).
+