Add configuration and documentation on how to enable NSEC3 when using dnssec-policy for signing your zones.