Setting up unbound to use dnssec and tor is super-easy too.

And once you set up the router, the cost of configuration is zero.

Dnssec still has your data in the clear, it just signs the data. (And is not supported by most domains)

DNSSEC only gives you two things, and only when all zones on the path to the domains you're looking at are signed: authentication of the response data, and authenticated denial of existence (NXDOMAIN).

DNSSEC does NOT encrypt requests nor responses.

Probably not. First of all, you'd need a large list of domains to query for randomly. Second, you'd have to actually have traffic with them, because if all you do is look up their info, but you connect only to the ones you want to talk to, then it's clear which ones you're talking to.