I just saw that bind now comes with tls support (for quite some time actually…), which was the reason I originally went with unbound instead. So I guess I have an excuse to look at it again… 😀