I wonder how big of a hassle to implement dnscrypt-proxy
https://github.com/opendns/dnscrypt-proxy inside m0n0wall once it comes into production-level quality code? I have it running on an secondary machine, but I would rather have the firewall/dns resolver itself support it.
I'm thinking out loud here...