Use DNSCrypt by default in Kicksecure? (not Whonix!)

I split the policy discussion from this and moved it here: