I must be missing something here: "The ODNS server can thus return the answer to the client’s stub resolver directly, possibly over a confidential channel such as D-TLS."
How does this not just move the trust problem to the ODNS server? Doesn't it now know both the requesting IP and the requested domain?
How does this not just move the trust problem to the ODNS server? Doesn't it now know both the requesting IP and the requested domain?