Like with DNSSec, make PrivateDNS configurable per link, so you can have trusted and untrusted links.