If only there were some technology that could verify whether a DNS query/response had been spoofed, without interfering with caching and proxying, and without t

If only there were some technology that could verify whether a DNS query/response had been spoofed, without interfering with caching and proxying, and without the privacy and centralization-of-control problems of DoH. If only such a technology had already been widely deployed in the dns root and many caches and resolvers.