You forgot to copy this line from my guide:
dnssec_return_status: GETDNS_EXTENSION_TRUE
appdata_dir: "/tmp/stubby"
To stubby.yml, this is what enables stubby to do dnssec validation. the appdata_dir is optional, but I recommend it, by default the keys are stored in /root, moving them to /tmp moves them to the RAM only.
From my guide: [Tutorial] DNS-over-TLS with dnsmasq and stubby (no need for unbound)
Explanation:
dnssec_return_status: GETDNS_EXTENSION_TRUE : This line provides DNSSEC validation
appdata_dir: Where the keys for DNSSEC are stored