Unfortunately, as far as I know, there is no way to know the machine's configuration or to make raw socket connections from the new WebExtensions, hence the use of HTTP.

However, I'm still looking for another HTTP resolver that does not involve Google and that does report DNSSEC status (OpenResolve public service does not, for example). I'm currently looking at a self-hosted OpenResolve resolver. Will get back to you.