A broken DNSSEC rollover took down .al. Now 1.1.1.1 tells you when validation is bypassed

When a failed DNSSEC key rollover took down the .al TLD, we deployed a Negative Trust Anchor to restore resolution.