After many frustrating hours staring at NetworkManager, wireguard, ip route, nslookup, etc. to discover why systemd-resolved refused to work on my home network (using pi-hole, which is why I want my VPN to work with it) and worked (127.0.0.53 resolved names) only if I was connected to mobile data, it turns out I just needed to disable dnssec! The trick was to see what "resolvectl query" was showing.

Allow downgrade was not enough. It had to be a straight "no".

This is also my first time with pmOS on systemd so there are some other things to adjust to.

Next critical issue with PinePhonePro and pmOS is FDE: https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/2916