At first I wanted to set up cloudflared for my pihole a la https://pimylifeup.com/raspberry-pi-cloudflare-tunnel/.
However, I realized this requires both a cloudflare account and setup of "tunnels" which I don't care to learn or sign up for (yet?).
I just want to encrypt DNS traffic. Let's just use DNScrypt - this guide is really all there is to it https://docs.pi-hole.net/guides/dns/dnscrypt-proxy/