The whole tower of Hanoi in pubkeygrab.sh script, complete with two greps and a sed could be replaced with just sed:

  unbound-host -v -D -t TXT ${USER}_pubkey.example.com \
   | sed 's/.*has TXT record "\(ssh-.*\)" (secure)/\1/p;d'

Or, even without sed, reducing to one-liner:

  dig +short +dnssec +sigchase txt $1_pubkey.example.com

EDIT: to address "wtf" concern by ryanlol, we can use a custom trust anchor:

  dig +short +dnssec +sigchase +trusted-key=/etc/my.key txt $1_pubkey.example.com