Technically stub resolvers and recursive resolvers are the same thing (one is an inherent part of the other). So all is needed is recursive resolvers to communicate securely with authoritative servers. Tunnels to third party recursive resolvers do nothing but leak private data to them.
At the same time traffic between stub resolver and recursive resolver is much more privacy sensitive.
So it makes sense to first get TLS between stub and recursive up and running. And that proves already hard enough.