A branch resolver forwards a private suffix correctly and DNSSEC failures...

The zone is forwarded to the right place, yet validation changes because the new path skips the resolver instance that knew to exempt that upstream.