I ran this same setup for a while, but became nervous about the potential for DNS poisoning. I'm reasonably confident in my ability to lock down a public-facing

I ran this same setup for a while, but became nervous about the potential for DNS poisoning. I'm reasonably confident in my ability to lock down a public-facing system, but you sure are putting a lot of trust in that pi-hole install and your ability to make sure you're always using SSL on every device and site.