These details are almost never included in these write-ups. Anyone have any guesses?
We have a similar setup with unbound and nsd (no need for powerdns for us). Even then it took a while to get it right because JVM apps especially love to hang for no reason doing NS lookups. You also need to specify -Dnetworkaddress.cache.ttl= etc since they don't listen to TTLs.
Running unbound on every single machine has saved us a lot of downtime.
Even to validate the DNSSEC records by yourself, there is only a single website available[1] (which doesn't even have TLS). I want DNSSEC to catch up, but adoption level is a joke.
Adoption is slow, nobody argues there, but when you've set it up and have routines for rolling keys it's more or less self-maintained.
Google public DNS will return servfail if validation fails, which is a step in the right direction.
There are plenty of tools to validate dnssec, even with TLS [0]. But I'm not sure why you would need a webpage to do it. You can easily grab the root keys and validate the whole chain using dig on your own computer.
What does this mean?
