I concur. Not sure why OC got downvoted but I do have a whitelisted Piehole at my home gateway in which to ensure that DNSSEC is clean AND that DNS nameserver

I concur. Not sure why OC got downvoted but I do have a whitelisted Piehole at my home gateway in which to ensure that DNSSEC is clean AND that DNS nameserver is a well-known vetted one. And DoH is harder to block once they go port 53 or https “incorrectly”.