fix(installer): relax DNSSEC to allow-downgrade, keep DoT strict

Venue resolvers that mangle DNSSEC records are common on hotel and airport wifi, and DNSSEC=yes turns that into no answer at all rather than an unauthenticated one. The encryption is the half worth being strict about, so DNSOverTLS stays yes.

This is not what fixes the clock deadlock, despite being the obvious reach. Resolved downgrades when a server lacks DNSSEC support, and a clock-skew signature failure is a validation failure, so no downgrade fires. Measured on velox: dead across six retries and a reset-server-features. The IP-addressed NTP source is what breaks that.

0 files changed, 0 insertions, 0 deletions