Just to clarify, it is a "government-run" PKI in the sense that some governments control some TLDs, as opposed to the CA ecosystem where a single rogue (government-run) CA can issue a certificate for any domain (happily ignoring any CAA record).

It would be nice to have something like Certificate Transparency for DNSSEC (at least for the TLDs), but for now CT has the problem that it is only a requirement for new certs, and a rogue CA could backdate a cert they maliciously created for your domain.