First, we are deploying DNS-over-HTTPS by default so that only a single party sees the target domain. Second, we require the DNS endpoints in Mozilla's Trusted Recursive Resolver program to legally commit to gathering a limited subset of data only for operational purposes, keeping the data confidential and deleting it promptly
I wonder if this program might be an interesting place to explorer carbon.txt related ideas.