val-max-restart is a bit awkward, maybe val-max-retries or val-retries-max would be nicer.
For now I went with how the #define was named. Let me know what you think, I'm happy to rename the option.

I did not regenerate the lexer and parser, I don't have the right versions for flex and bison around and it should be a separate commit anyway I guess?

I've also checked what other resolvers are doing by asking for sigexpired.bad-dnssec.wb.sidnlabs.nl A
bind: similar to unbound, seems to do even more work
powerdns-recursor: gives up after encountering the DNSKEY with expired RRSIG. This is what unbound will do with val-max-restart: 0.
knot-recurser: gives up after encountering the expired RRSIG for A, doesn't bother with the DNSKEY.

I like this!

LGTM, thanks!
I'll generate the lexer and parser.