It sounds like you don't have DNSSEC=yes anywwhere. I can do the following.
root@mantic:~# resolvectl dnssec
Global: no
Link 41 (eth0): no
root@mantic:~# dig +short DS ripe.net
root@mantic:~# resolvectl dnssec eth0 yes
root@mantic:~# resolvectl dnssec
Global: no
Link 41 (eth0): yes
root@mantic:~# dig +short DS ripe.net
10186 13 2 BC15C85E16FE7C651EAAFCEE3B1F1C956217A5B70A536BFEF38C24A9 AB7B9A3F
It sounds like you don't have DNSSEC=yes anywwhere. I can do the following. 51EAAFCEE3B1F1C 956217A5B70A536 BFEF38C24A9 AB7B9A3F
root@mantic:~# resolvectl dnssec
Global: no
Link 41 (eth0): no
root@mantic:~# dig +short DS ripe.net
root@mantic:~# resolvectl dnssec eth0 yes
root@mantic:~# resolvectl dnssec
Global: no
Link 41 (eth0): yes
root@mantic:~# dig +short DS ripe.net
10186 13 2 BC15C85E16FE7C6