text: Title: nslord: stop publishing DS records with SHA-1
  Body: In agreement with [RFC 4509 Sec. 3](https://tools.ietf.org/html/rfc4509#section-3):
  > Implementations MUST support the use of the SHA-256 algorithm in DS RRs.  Validator implementations SHOULD ignore DS RRs containing SHA-1 digests if DS RRs with SHA-256 digests are present in the DS RRset.
  
  This requires a change [here](https://github.com/desec-io/desec-stack/blob/master/nslord/conf/pdns.conf.var#L7), and ideally (but not necessarily) delegation updates of the domains we are authoritative for.