Some notes on how I secured some privacy on my local network and extended it to non-local situations:
Pi-Hole, default installations
Discussion on Google v. Cloudflare v. Others v. Quad9 How do you know you're using Quad 9
Use of Stubby as an encrypting 'interposer' for DNS queries
Use of Tailscale to create a virtual 'network' that functions across the Internet and thus allows Pi-Hole+Stubby to be used for DNS query resolution, even in public environments.