I understand that, but similarly to cloudflare/nextdns they could just provide unfiltered anycast service (with DNSSEC).