Which makes sense, because there is (in general) not much point in protecting traffic between recursive and auth. servers if you don't protect the stub resolver.

At the same time traffic between stub resolver and recursive resolver is much more privacy sensitive.

So it makes sense to first get TLS between stub and recursive up and running. And that proves already hard enough.

Technically stub resolvers and recursive resolvers are the same thing (one is an inherent part of the other). So all is needed is recursive resolvers to communicate securely with authoritative servers. Tunnels to third party recursive resolvers do nothing but leak private data to them.

But traffic to a recursive resolver can already be protected by other means, e.g. a tunnel to one that you control. There are zero options for contacting the authoritative ones.