Add some useful-looking TLSA records to hedge against CA uselessness.