> By querying ... and comparing

Checking crypto signature is more reliable, imho

I think best way to go is both, DNSSEC and DoT.

> People are going to assume "I am using DNSSEC so I cannot be vulnerable to DNS poisoning."

I'm one of those suckers :D