Best of both worlds (until Dnsmasq's DNSSEC support stabilizes, which is in progress).
Summary: DNSMasq will do its normal thing for the local network, passing anything it can't resolve to unbound on a local port, which does the heavy recursive DNSSEC lifting. (Since the recursive lookups take time, you will not get the benefits of a heavy usage ISP DNS server and things may be slower to look up.)
1) Install unbound via your normal mechanism (opkg etc).
2) Edit unbound.conf. Key line to...
Simple Tomato DNSSEC (Unbound + Dnsmasq)
Summary: DNSMasq will do its normal thing for the local network, passing anything it can't resolve to unbound on a local port, which does the heavy recursive DNSSEC lifting. (Since the recursive lookups take time, you will not get the benefits of a heavy usage ISP DNS server and things may be slower to look up.)
1) Install unbound via your normal mechanism (opkg etc).
2) Edit unbound.conf. Key line to...
Simple Tomato DNSSEC (Unbound + Dnsmasq)