Enabling DNSSEC (dns.dnssec = true) would have Pi-hole send additional DNS requests to authoritative DNS servers that it needs for validating DNS replies.
dns.showDNSSEC controls whether those additional requests would appear in Pi-hole's Query Log.
A validating recursive resolver like unbound would already verify DNS replies via DNSSEC, so when using that as Pi-hole's upstream, there would be no need to also enable DNSSEC in Pi-hole.
If you'd opt to do so nevertheless, you should be aware of unbound already validating replies, so you may want to adjust unbound to provide extra information to Pi-hole about discarded DNS replies.
For additional insights, please refer to Understanding DNSSEC validation using Pi-hole's Query Log.