I think its going to come down to smart network management in the client OS. If I'm on a trusted network, use the network resolvers (either via UDP 53 or DoH,

I think its going to come down to smart network management in the client OS. If I'm on a trusted network, use the network resolvers (either via UDP 53 or DoH, or whatever) and if I'm not use preconfigured resolvers like 1.1.1.1 or something, part of not trusting the network should also be not trusting the resolver. Before DoH this was a moot point since UDP 53 can be trivially captured and redirected, now the client OS can actually do something about it. I don't like the idea of individual applications overriding system resolver settings.