nss-tls is "at the OS level". It makes getaddrinfo(), etc', use DoH behind the scenes, so applications are transparently migrated to DoH.

I think you missed the nss-tls README and think nss-tls is not at the "OS level".