Here’s a hint as to what’s wrong with system-level networking services on macOS 15.1: Safari has inconsistent DNSSEC signature problems, while Chrome and Firefox (which use their own networking engines) do not. Every query has a different subset of signature problems.
I think I'm too rusty on cryptography implementation to meaningfully debug this further; here's hoping Apple patches this soon.