Sha1 runtime insecure change was incomplete about unbound

[wcawijngaards]

The issue was that the DS record for the site had a number of nonmatching DS entries, for like a key rollover, for keys that are not in the key set. Because of these entries, the result was bogus, because they did not match anything. The fix checks that when no entry has matched apart from cryptolib refusals, and there are cryptolib algorithm refusal entries, it becomes insecure for the delegation point DS record check.

That fixes the lookup that is cited in the issue, it was not really about the specific DNSKEY algorithm, but about the DS RRset entries, and the lookup cited in the issue then becomes insecure and resolves. Thanks for the report!