add synthetic TLSA (no handling yet)