NSEC3 without a corresponding record (or empty non-terminal)

[tobez]

Daniel Stirnimann writes:

I have a question regarding the DNSSEC check "NSEC3 without a
corresponding record (or empty non-terminal)".

My sample zone example.com looks as follow:

$TTL    1d
$INCLUDE Kexample.com.+008+18169.key
$INCLUDE Kexample.com.+008+57699.key
@       IN      SOA     ns.example.com. hostmaster.example.com. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL

        IN      NS      ns1.example.net.
1.1.1.1.1.1.1.1.1.1.33  IN      NS      ns1.example.net.

I sign the zone with the following command:
dnssec-signzone -t -3 94CD -H 1 example.com

validns (v0.4) gives me ten validation errors for the above mentioned
"empty non-terminal" check.

Why is this considered an error? Empty non-terminals have NSEC3 records.
So where is the problem?