option set: statements with a name replace only that one; forwarding over TLS documented

jarl option set tls NAME (and key, remote-servers, primaries, http, dnssec-policy, key-store, server, acl, view, zone, parental-agents) matches the name after the keyword too: setting tls cloudflare no longer replaces tls quad9. jarl option unset tls NAME removes one by its name. docs/encrypted-dns.md has forwarding to Quad9 or Cloudflare over TLS: one changeset, the options explained, several providers, checking it works, and why not over HTTPS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -497,6 +497,27 @@ run "acknowledged: info, with the reason" 0 $J exposure
 contains "info  *external  *security_open_resolver .*acknowledged by .*e2e: on purpose"
 run "take it back" 0 $J exposure unack external security_open_resolver
 run "close the resolver again" 0 $J option unset allow-recursion --view external
+# Statements told apart by their name (tls NAME, key NAME, ...): setting
+# one replaces only the one of that name.
+run "a tls statement for forwarding" 0 $J option set tls 'e2e-quad9 { remote-hostname "dns.quad9.net"; }' --toplevel
+run "a second one, without --add" 0 $J option set tls 'e2e-cf { remote-hostname "cloudflare-dns.com"; }' --toplevel
+run "both are there" 0 $J option list --toplevel
+contains "e2e-quad9"
+contains "e2e-cf"
+run "changing one leaves the other" 0 $J option set tls 'e2e-quad9 { remote-hostname "dns11.quad9.net"; }' --toplevel
+run "list" 0 $J option list --toplevel
+contains "dns11.quad9.net"
+contains "e2e-cf"
+not_contains '"dns.quad9.net"'
+run "unset needs to know which (exit 1)" 1 $J option unset tls --toplevel
+contains "say which: jarl option unset tls"
+run "forwarders over TLS" 0 $J option set forwarders '{ 9.9.9.9 port 853 tls e2e-quad9; 1.1.1.1 port 853 tls e2e-cf; }' --view internal
+run "named.conf has them" 0 grep -q 'tls e2e-quad9' $E/etc-jarl/named.conf
+run "take the forwarders out" 0 $J option unset forwarders --view internal
+run "unset one by its name" 0 $J option unset tls e2e-cf --toplevel
+run "and the other" 0 $J option unset tls e2e-quad9 --toplevel
+run "none left" 0 $J option list --toplevel
+not_contains "e2e-quad9"
 run "fix: hide the version" 0 $J exposure fix server exposure_version
 expect_dig "version.bind is hidden" "" -c CH version.bind TXT
 run "mark external private" 0 $J view update external --exposure private