Knot-resolver now validates by default in forwarding mode as well. I find it most likely that your ISP’s DNS servers obstruct some DNSSEC records. Easiest ways around that in Foris are either (a) leave forwarding and disable DNSSEC validation (basically the state you had before 3.8, apparently) or (b) disable forwarding and leave DNSSEC validation.