http://thread.gmane.org/gmane.linux.redhat.fedora.devel/214534

tldr:
лёнчику печёт от proposal'a ставить в пидорке локальный unbound для валидации DNSSEC
приписка в конце письма: Disclaimer on all of this: we are working on adding DNSSEC support to systemd-resolved, and about ways to make this available by default, without breaking too much stuff. I am convinced that the stuff we are working on there is definitely the better approach in the end, than this current feature proposal.