When following a CNAME chain, if any lookup is insecure the whole must be too