dns_filter: feature req - DNS over TLS

Today, the upstream resolver is specified using IP/Port like this:

dns_filter:
   client_config:
      resolver_timeout: 5s
      upstream_resolvers:
        addressList:
        - address: 8.8.8.8, port: 53 #only plaintext dns
      max_pending_lookups: 256

If we allow the specification of upstream resolvers using a cluster name reference, we will get DNS over TLS for free in addition to bunch of other [weird] functionalities. For example,

dns_filter:
   client_config:
      resolver_timeout: 5s
      upstream_resolver_cluster: my_dns_cluster
      max_pending_lookups: 256
...
Clusters:
- name: my_dns_cluster
  type: STATIC
  lbEndpoints:
  - 8.8.8.8, port 853 
  upstreamTLSContext:
  ....

If the request is not satisfied within the resolver_timeout period, then the resolution fails [just like http route timeout]. The question is should there be an API-ish mechanism to constrain the cluster type to just static or should we let the user use any normal cluster (strict_dns, eds, etc.). It doesn't really matter to the client_config as its just consuming the response from the cluster object.