As someone who doesn't know anything about DNSSEC, that was a helpful introduction! One thing I don't understand is, why all the complexity in NSEC/NSEC3? Coul

As someone who doesn't know anything about DNSSEC, that was a helpful introduction! One thing I don't understand is, why all the complexity in NSEC/NSEC3? Couldn't you just have an NSEC-type record that returns "tustee.ietf.org does not exist" for a single record rather than a range? If the issue is that returning any result for tustee.ietf.org would be construed as a positive "it exists" by older resolvers, couldn't you just namespace it behind not-found.arpa or something?