Double trouble for DNSSEC though the devil is in the details