DNSSEC health check: reports whether a domain is DNSSEC-signed (DNSKEY), has a DS record at the parent, and whether the resolver authenticated the answer, with advisory warnings.