sync with external work, part 2: this adds an error list, and fixes a major NSEC3...