Carl;
http://www.isc.org/products/BIND/delegation-only.html
As I just post to DNSOP WG ML (detailed discussion should be done
there), it is not an effective protection against synthesised (from
wildcared NS, in this case) NS and synthesised (from scratch) child
zone contents.
A protection is to reject NS answers, if it is identical to wildcarded
one, though it has several side effects.
Masataka Ohta