The dnscrypt: clause gives the settings of the dnscrypt channel. While
those options are available, they are only meaningful if unbound was
compiled with --enable-dnscrypt. Currently certificate and secret/pub-
lic keys cannot be generated by unbound. You can use dnscrypt-wrapper
to generate those: https://github.com/cofyc/dnscrypt-wrapper/blob/mas-
ter/README.md#usage
From the manual: