As a side effect the unit files now live in "/lib/systemd/system" instead of
"/usr/lib/systemd/system".

API permissions errors on BIND (i.e. lack of scope "checkpassword") are now
reported as insufficientAccessRights (50) and rate limit errors as
unwillingToPerform (53). Previously other (80) was used in both cases, which
confused some clients (Nextcloud to be precise).

The option breaks Python's OpenSSL support (on Debian Buster at least).