@dalias Definitely sounds much nicer from a security perspective.
What would be a 'trusted upstream' in your mind though? Sounds like it'd be a real challenge for a project to select their upstream without any controversy. I remember a fair bit of it when Mozilla partnered with Cloudflare to provide DoH.