Comment by buffrr

Something to consider in the future is implementing RFC9102[0] which is an experimental TLS extension for embedding the DNSSEC chain this should significantly improve TTFB. It'll still need to request the DS record/trust anchor from the p2p client.

[0] https://www.rfc-editor.org/rfc/rfc9102.html