Shutting down our public encrypted DNS

I can sense the doubt in the questions but I assure you what I'm discussing is just the defaults behavior of most DNS server software. E.g., I'll walk through below with BIND's default behavior when configured with recursion and a forwarder entry. The downstream forwarder (our BIND server) asks for all of the relevant DNSSEC records for the query to "example.com." from the root on down the FQDN. The upstream responds with a set of record responses. One of 3 things happens:

1) The signature chain checks out all the way to the root, who's key info comes from a file included the DNS software rather than a DNSSEC query. The integrity of the end record is trusted (not the upstream itself) and the process is complete.

2) The signature chain checks out but part way down it (explicitly) ends early. E.g. "example" is not configured for DNSSEC but "com" and "." are so .com ends the signature chain with a signed "example will not be signed" handoff. The process is complete, the record is securely known to be insecurely defined by the authoritative servers for "example" per the signatures from the .com records and the local security anchor (e.g. bind.keys file)

3) The signature chain doesn't validate at some point. This could be because the malicious upstream tried to modify a record or it could be because the malicious upstream tried to fake lack of record response even though it can't fake the parent domain's signature of that (recursively to the root because the root keys are local to the server). In this case, the invalid records from the malicious upstream are jettisoned in favor of trying to get valid responses via recursive resolution.

.

Tying it all back together: Because the downstream forwarder is only looking for the signature chain to trust the record, it just wants to get those records as fast as possible. BIND determines the most likely way to get a quick response is to ask the forwarder. It then checks the full signature of all of these, almost always bind was right - the forwarder had the records needed cached and didn't try to modify them. If the forwarder was malicious or just in error bind throws these away and tries to recurse the answer directly.

Quad9 wants people to disable it because it's extra record requests, most people don't care, and, if you trust Quad9, you can just send your request in a DoH or DoT tunnel to secure the last hop more efficiently while they do the validation of the record itself.

We had arts and sciences being funded long before copyright even existed. Your concern is not based in reality. If people want something to exist they will be willing to pay for its creation.