net.unbound: Enable DNSSEC by default with option for turning off You know what they say about opt-in security. Enabling DNSSEC in libunbound without a way to turn it off would likely be a problem for those whose DNS resolvers do not support, or outright block DNSSEC. The merge algorithm already in place here doesn't have a way to unset something, so instead a simpler boolean setting is introduced, similar to some existing ones like use_ipv6/4 and use_dane.

--- a/CHANGES	Sun Jun 07 18:23:24 2026 +0200
+++ b/CHANGES	Sun Jun 07 20:32:55 2026 +0200
@@ -27,6 +27,10 @@
 - mod_mam has a new `archive-query-result` event
 - stanza meta api
 
+## Changes
+
+- DNSSEC support in libunbound enabled by default, requiring root DNSSEC trust anchors
+
 13.0.0
 ======