test that a RRset whose TTL values differ from RRSIG's 'Original TTL' field is rejected

[japaric]

section 3.1.8.1 (Signature Calculation) of RFC4034 says

Each RR in the RRset MUST have the TTL listed in the RRSIG Original TTL Field

NOTE: the RFC may be referring to the TTL values written in the zone file because this requirement does not uphold in records received by a resolver / nameserver client. for example:

$ dig @1.1.1.1 +recurse +dnssec A example.com.
example.com.		3175	IN	A	93.184.215.14
example.com.		3175	IN	RRSIG	A 13 2 3600 (..)

3600 is the original TTL value but it does not match the TTL value of A record nor the TTL of the RRSIG record