I’ve wondered about this sort of thing too, but I figure that their response will be “if we can’t see what domain you’re visiting, we’ll just stop you from visiting it”. Ditto with vpn traffic. They’ll whitelist paying traffic and slow everything else.

Does DNSSEC provide encrypted queries / answers?

I was under the impression it only provides authenticity and integrity for answers. (I am by no means an expert, though!)

They can still unavoidably see which host you're visiting, and will divide their traffic into "paid priority" and "everything else".

No, they can still see the IP address of the site you visit.