s4 dns: Verify incoming TSIG signatures