[tptacek]

You mean it helps record integrity. The "security" story with DNSSEC is much more of a mixed bag than that; there's a reason it's very rarely deployed in the industry.

You're definitely right to point out that DoH helps with the VPN DNS privacy problem and DNSSEC doesn't.