A branch resolver forwards a private suffix correctly and DNSSEC failures...

The suffix is forwarded to the right resolver, yet validation changes because the path no longer includes the resolver with the local exception.