I agree that governments control the DNS today.
The problem is that DNS does not in turn control Internet cryptography, and DNSSEC's primary use case is to change that.
That's a strange thing to say. DNS is pretty much the only thing that controls Internet cryptography. The number of non-domain validated certificates is vanishingly small.
Do I understand this correctly?
If there is a blacklist in place, absolutely each and every one of the hundreds of CAs need to adhere to it. One mistake or one exception and I could still get a misissued certificate just as easily as ten years ago.
Google can probably get it revoked very quickly, but we all know how well that works in practice. The only saving grace for the CA system is key pinning, and that's the only reason all those corrupt and/or incompentent CAs were exposed lately. But key pinning is not enough in itself. It is complementary to your certificate validation path(s).
And not all ccTLDs are controlled by that country's authorities, they are normally delegated to other organizations which in some cases may not even be under their jurisdiction.
There's also no movement of control to "governments". The entity that controls the TLD has authority over DNS, today, and the one with authority over DNS are in full control over DLV TLS certificates, today. Any pinning and transparency checks would work unimpeded in a DNSSEC world.
DNSSEC just makes it much harder to improperly get an TLS certificate. Today you just need to annouce their AS for a while, or cache spoof any of the hundreds of CAs. No CA has ever been dropped for signing a certificate by the rules. The only reason we don't see that more is because it's apparently even easier to bribe or force a CA to give them out. NSA certainly doesn't need to attack anything to get certificates issued, today.