Update to new test9 release.
Relevant excerpt from git shortlog between test8 and test9:
Add RFC-6605 ECDSA DNSSEC verification.
Don't mess with the TTL of DNSSEC RRs.
No CD in forwarded queries unless dnssec-debug for TCP too.
Log BOGUS validation result when upstream sends SERVFAIL.
--rev-server option. Syntactic sugar for PTR queries.
Omit ECC from DNSSEC if nettle library is old.
Add --servers-file option.
NSEC3 validation. First pass.
Check signer name in RRSIGs.
An NSEC record cannot attest to its own non-existance!