For DNSSec signed DNS records, verify the signature and provide feedback to the UI for at least the different cases of trusted, broken, and expired. Apparently signed-but-expired is expected to be a fairly common case so it should be treated less aggressively than broken-signature.