I am not against DoH, but it only helps with the privacy of the request/response wrt snoopers. It doesn't help with the authenticity of the response, which is t

I am not against DoH, but it only helps with the privacy of the request/response wrt snoopers. It doesn't help with the authenticity of the response, which is the problem being addressed by this mechanism. (That the firefox solution works is due to the root servers themselves being deemed trustworthy, and the ISP ones being tentatively not, but the DNSSEC solution is strictly better as now nothing needs to be trusted.)