make USE_NSEC work as expected