SOLVED The developers added code to pihole-FTL, which is the latest dnsmasq + features (to make pi-hole the better solution). full story (pi-hole forum) here: https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217