Support that a security-aware caching resolver accepts a DNS RRset at time t0 with signatures on it which will expire at time t1 (where t0 < t1), and the RRset's TTL is n. In accordance with the DNS, RRsets must be cached for the duration of the TTL and then discarded. What must a security aware resolver do if t0 + n > t1?