No assumption of DoH/DoT for resolvers

[paulehoffman]

In section 4:

Of course, observation and modification are still possible when performed by the recursive resolver, which decrypts queries, serves a response from cache or performs recursion to obtain a response (or synthesizes a response), and then encrypts the response and sends it back to the user's stub resolver.

This assumes that the resolver is using DoH/DoT to every stub resolver it serves, which really should not be a requirement for encrypting to the authoritative. I propose removing this.