replace the use of RBTs for deny-answer-aliases, the exclude lists for deny-answer-aliases and deny-answer-addresses, and dnssec-must-be-secure, with name trees.