Yes, I use Unbound :)

It’s configured exactly like I mentioned: it tries a couple of resolvers, and if they all fail, tries authoritative servers starting from the root. That last part, missing from your suggested configuration, is the key: it’s what ensures courts have to actually go after the parties responsible for the domain, and not just random DNS resolvers.

> Beyond that I think you are asking for behavioral and RFC changes to everyone's workstations, cell phones, tablets, TV's, and DNS resolvers.

We did it once for DoH/DoT, we could do it again.