No longer require both DNSKEY and RRSIG record

[egberts]

as of late, many DNSSEC hosts no longer provide the second RRSIG record as well as the DNSKEY record.

This snippet requires both.