A zone that is signed with NSEC3, opt-out enabled, and then reconfigured to use NSEC, causes the zone to be published with missing NSEC records. This has been fixed.
Closes #5679
Backport of MR !11359
Merge branch 'backport-5679-nsec3-optout-to-nsec-9.20' into 'bind-9.20'