Ed,
I'm having trouble understanding your specific concerns.
There is a clear semantic difference between NXDOMAIN and NOERROR/NODATA.
The first indicates that the name does not exist (and could not have been
synthesized by a wildcard). The second indicates that the name exists (or
was
>Note however that Cloudflare quite deliberately implemented this differential
>behavior (to preserve NXDOMAIN visibility for pre DNSSEC clients I suspect).
>Some other implementations of Compact DoE return a uniform (NOERROR) RCODE for
>either case.
The trouble I have, thinking about the
