net.unbound: Enable DNSSEC by default with option for turning off You know what they say about opt-in security. Enabling DNSSEC in libunbound without a way to turn it off would likely be a problem for those whose DNS resolvers do not support, or outright block DNSSEC. The merge algorithm already in place here doesn't have a way to unset something, so instead a simpler boolean setting is introduced, similar to some existing ones like use_ipv6/4 and use_dane.