i think you have to set up DoH with unbound to make it not be in cleartext? I dunno honestly I'm a dummy, but I'm fairly sure that it's pretty tricky to get it totally secured. I guess I don't understand why you can't use ubound recursively but have its root.hints pointing as something like quad9 instead of all the actual root authoritative dns servers, theres like 13 of them and more than half are the US government.