Google devices (so maybe apple ones as well) sometimes hard code the dns server so you need to redirect dns request to you local unbound instance with a firewall rule.

In short yes They all have their own key pair. Private and public Each client should know the “servers” public key. And the “server” should know the client’s public key(s)

Open source hardware movement != Free open source hardware movement.

I’m not sure that many are advocating the free part mainly the open part.