There's some irony here: short expiry has some clear practical benefits for at least some of the goals of the WebPKI, and that works because the WebPKI has stakeholders that will push things like "if you issue one more SHA1 certificate we will distrust your CA". Certificate expiration failures are common, but not that common, because "needs a certificate" isn't the default for every host.

Key expiry is a much bigger problem for DNSSEC, since once you sign, every hostname in your whole zone depends on no RR in your DNS configuration expiring. But there are no stakeholders extracting any value from those expirations: nobody can say "if you sign one more record with RSA-1024 we will break your whole TLD".

Further, unlike with the WebPKI, where verification is conceptually offline --- you have a trust anchor and a signature chain and the verification is all done locally --- DNSSEC resolution is online: you have a TTL issue with revocation, but not a "this bogus signature will be valid for an entire year because there is no effective revocation system".

So, arguably, the RRSIG expiration field is another fundamental flaw with DNSSEC.