I think in order to make dnssec/local resolver the default, it should be
required to work for a naive user who works in a changing environment such
as:
moving between work, which has it's own private dns and
home, which has usual, public dns
without that user needing to understand anything about configuring the
components. For example, when I'm at work, I can access
hostA.work.com
where resolving hostA only works by talking to
dnsserverA.work.com, which
was setup by the usual dhcp
and then when I'm at home
google.com
is resolved as normal, using my ISP's dhcp to configure dns.
And this must work without the user ever editing some unbound config file.