NSEC3PARAM RR is not stripped when signing. #407
Description
If an input zone file contains an apex NSEC3PARAM RR but is signed with an NSEC policy (NOT NSEC3) then the resulting signed zone still has the NSEC3PARAM RR in it which casues dnssec-verify to complain about missing NSEC3 RRs.