in the end I went with CanSpace as registrar, and I’m using CloudFlare to actually run the nameservers.
The transfer was kind of a PITA because since the domain transferred from Google to Squarespace to Canspace to then being hosted on CF’s nameservers (but still on Canspace) the DNSSEC meant that CF couldn’t actually get it connected until like 48 hours later. Was quite worried that I’d screwed up somewhere.