Comment 9 for bug 1723900

This bug silently deactivate DNSSEC on systems where Unbound is installed. The system will fallback to the default resolver and happily resolve dns queries with invalid signatures.

This should be marked as a security issue.

Problem resolved (no pun intended) with the provided patch, then reloading the apparmor configuration.
systemctl reload apparmor.service
systemctl restart unbound.service