That’s an insane argument that will just be continuously abused to erode privacy until everything you do is under surveillance by the government.

Oh you’re against DNS over HTTPS? Oh so you want our children to be abused? You’re for encryption? Sounds like someone doesn’t care about child porn. Oh you won’t share your Password with the government? Hiding something?

Do the same thing you do for other illegal things: throw the law at the people hosting them, and if those people are international, use good ole diplomatic levers to get the countries in question to shut them down.

Look, child pornography is deeply troubling, but so are lots of other things in life that people don't call for mandatory, obtrusive government censorship to prevent. The mandatory DNS blocking to prevent child porn is not particularly effective. In non-technical terms, DNS blocking is effectively the same as taking down the sign on the front door: it doesn't prevent anyone from getting to it, if they know where to look, and even people who might trap unwitting visitors into traveling to these sites can still do so (you can use IP addresses in lieu of domain names in links).

Indeed, if you know the DNS addresses of places to avoid, you actually know enough information to take more proactive action: for example, you could mandate that the IP addresses these sites use (or even the ISPs who host them!) are made to be unreachable, which would make it much, much more difficult to actually access these sites. Blocking only the DNS address is pretty much doing the barest minimum to look like you're tackling the problem.

First step would be to stop creating an environment where discussion of the issue can't even happen. Blocking content featuring the sexualization of children from spreading is a good goal but a better goal is to prevent it from being produced in the first place. We need better ways of making that happen, including providing ways for those who are mentally ill and want help overcoming it to get it. It's not an easy problem to combat and there probably will never be a perfect solution but instantly losing all semblance of rational though at the mere mention of the subject isn't helping much.

Stop routing traffic to/from ASes that host child pornography.

I mean, this is not about some deep darknet stuff or tor hidden services (where DNS filtering would not be effective anyways), so my question is why isn't government able to shut these sites down? And if the sites are hosted on uncooperative ISP then I think dropping the traffic is appropriate response.

As others have mentioned, if you know enough to make a blanklist, you know enough to go after the sites that host it. Better yet, instead of playing whack-a-mole with blocking sites (it's incredibly cheap to get a new IP/domain), go after those who make it (set up a sting and arrest a ton at once).

If a site is in another jurisdiction, you can still distribute a list of sites to ISPs, and ISPs can report suspicious activity to the police (so they can get a warrant for closer monitoring).

If you block it, you just alert people to which sites are more likely to have illegal content, which can encourage them to access it through other means (VPN, Tor, etc). I honestly don't see any real value in it from a practical perspective, and the only real "benefit" is it gives the government an excuse to add other stuff to the list it doesn't like.

First step: stop using a nuclear warhead to kill a wolf. The only worst thing to do would be to destroy humanity, so child pornography will be permanently dealt with.