First, I know nothing about DoH, so take this with a grain of salt.
They should look up a canary domain that doesn't resolve from the roots, but local sites can configure to provide the address of a DoH resolver. Then you don't need to have a list of known DoH providers-- any site can install a DoH resolver and then add the canary domain to allow clients to upgrade.
It'd still be vulnerable to MITM attacks on initial connect, but at least the window for them is closed after the first resolution with this approach (better than normal DNS).
