diff --git a/README b/README
index 3a0e770..eb7d2b5 100644
--- a/README
+++ b/README
@@ -11,7 +11,8 @@ are part of BIND 9.
 These tools depend upon DNSjava (http://www.xbill.org/dnsjava), the
 Jakarta Commons CLI and Logging libraries (http://jakarta.apache.org),
 and Sun's Java Cryptography extensions.  A copy of each of these
-libraries is included in the distribution.
+libraries is included in the distribution.  Currently, these tools use
+a custom version of the DNSjava library (for NSEC3 support)
 
 See the "licenses" directory for the licensing information of this
 package and the other packages that are distributed with it.
@@ -25,7 +26,7 @@ Getting started:
 2. run the various tools from their unpacked location:
 
 % cd java-dnssec-tools-x.x.x
-% ./bin/signZone.sh -h
+% ./bin/jdnssec-signzone -h
 
 Building from source:
 
@@ -37,12 +38,16 @@ that the binary distribution was unpacked.
 2. edit the build.properties file to suit your environment,
 particularly the use of the jikes compiler.
 
-2. run Ant (see http://jakara.apache.org for information about the Ant
+3. run Ant (see http://jakara.apache.org for information about the Ant
 build tool).
 
 % ant
 
----
+4. You can build the distribution tarballs with 'ant dist'.  You can
+run the tools directly from the build area by using the
+./bin/_jdnssec_* wrappers.
+
+ ---
 
 Questions or comments may be directed to the author
 (mailto:davidb@verisignlabs.com) or sent to the
diff --git a/VERSION b/VERSION
index 176df46..95cbd03 100644
--- a/VERSION
+++ b/VERSION
@@ -1,3 +1,2 @@
-version=0.3.0
-tagversion=0_3_0
+version=0.4.0
 
diff --git a/build.properties b/build.properties
index f034b8c..b4d59bd 100644
--- a/build.properties
+++ b/build.properties
@@ -1,3 +1,3 @@
-build.compiler=jikes
+#build.compiler=jikes
 #build.compiler=modern
 build.deprecation=true
diff --git a/build.xml b/build.xml
index e6beaab..9ccc2c5 100644
--- a/build.xml
+++ b/build.xml
@@ -156,7 +156,7 @@
 
   <target name="dist" depends="sectools-dist">
    <echo message="do not forget to tag the release:" />
-   <echo message="  cvs tag V_${tagversion}" />
+   <echo message="  svn-tag ${version}" />
   </target>
 
   <target name="usage">
diff --git a/src/com/verisignlabs/dnssec/cl/SignZone.java b/src/com/verisignlabs/dnssec/cl/SignZone.java
index c134a9f..ae7c89d 100644
--- a/src/com/verisignlabs/dnssec/cl/SignZone.java
+++ b/src/com/verisignlabs/dnssec/cl/SignZone.java
@@ -132,6 +132,12 @@ public class SignZone
       if (cli.hasOption('3')) useNsec3 = true;
       if (cli.hasOption('O')) useOptIn = true;
 
+      if (useOptIn && ! useNsec3)
+      {
+        System.err.println("OptIn not supported without NSEC3 -- ignored.");
+        useOptIn = false;
+      }
+      
       if (cli.hasOption('F')) fullySignKeyset = true;
 
       if ((optstr = cli.getOptionValue('d')) != null)
@@ -184,11 +190,11 @@ public class SignZone
         includeNames = getNameList(includeNamesFile);
       }
 
-      if ((optstr = cli.getOptionValue("salt")) != null)
+      if ((optstr = cli.getOptionValue('S')) != null)
       {
         salt = base16.fromString(optstr);
       }
-      if ((optstr = cli.getOptionValue("random-salt")) != null)
+      if ((optstr = cli.getOptionValue('R')) != null)
       {
         int length = parseInt(optstr, 0);
         if (length > 0 && length <= 255)
@@ -269,10 +275,10 @@ public class SignZone
 
       opts.addOption(OptionBuilder.hasArg().withLongOpt("salt")
           .withArgName("hex value").withDescription("supply a salt value.")
-          .create());
+          .create('S'));
       opts.addOption(OptionBuilder.hasArg().withLongOpt("random-salt")
           .withArgName("length").withDescription("generate a random salt.")
-          .create());
+          .create('R'));
       opts.addOption(OptionBuilder.hasArg().withLongOpt("iterations")
           .withArgName("value")
           .withDescription("use this value for the iterations in NSEC3.")
diff --git a/src/com/verisignlabs/dnssec/security/SignUtils.java b/src/com/verisignlabs/dnssec/security/SignUtils.java
index 632fb99..737ec5e 100644
--- a/src/com/verisignlabs/dnssec/security/SignUtils.java
+++ b/src/com/verisignlabs/dnssec/security/SignUtils.java
@@ -470,7 +470,7 @@ public class SignUtils
       Record r = (Record) o;
 
       // First record
-      if (rrset.getName() == null)
+      if (rrset.size() == 0)
       {
         rrset.addRR(r);
         continue;
@@ -828,7 +828,7 @@ public class SignUtils
     for (int i = 1; i < ldiff; i++)
     {
       Name n = new Name(node.name, i);
-      log.info("Generating ENT NSEC3 for " + n);
+      log.fine("Generating ENT NSEC3 for " + n);
       ProtoNSEC3 nsec3 = generateNSEC3(n,
           zonename,
           node.ttl,