Package: dnsmasq-base Version: 2.90-4~deb12u2 Long time user, first time caller.
This package is shipping with outdated dns trust anchor information in /usr/share/dnsmasq-base/trust-anchors.conf causing all DNSSEC validations to fail.
Rather than correcting it I suggest making the package dependent on dns-root-data which appears to be the Debian package for maintaining DNS data.
