Making NSEC5 Practical for DNSSEC