Upstream DNS-over-TLS support?

[cottand]

As in allow leng to perform DoT queries to upstream resolvers, much like it does for DoH.

I think this is a nice to have only, as we are already capable of secure private DNS via DoH. DoT can be blocked and it is easier to spot (since it uses port 853). If we implement it, should be disabled by default I reckon