My unbound configuration, use securedns.eu with dnssec validation

unbound.conf

server:
    verbosity: 1
    port: 53
    username: "jonny"
    tls-cert-bundle: "/usr/local/etc/openssl@1.1/cert.pem"
    auto-trust-anchor-file: "/usr/local/etc/unbound/root.key"
    aggressive-nsec: yes
    hide-identity: yes
    hide-version: yes
    prefetch: yes
    rrset-roundrobin: yes
    use-caps-for-id: yes

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 146.185.167.43@853#dot.securedns.eu