You can clone with
We need a cd=1 option in the URL, so we can try with a validating resolver and domains like www.dnssec-failed.org...
Apparently, there is no way to set the CD bit in DNSpython with the high-level resolver interface. This is why this bug depends on #3.
Done in 677548c