As we are running to 2 solution in for our company, here is a rather fair point of view.
When you are outsourcing the CA or DNSSEC service, all that's matter is how much trust do you have in the 3rd party company providing your the outsourced service. In order the outsource the complexity you'll have to rely on on the secure practices of the CA/DNSSEC provider.
For the 2 services, the main point you'll have to take about is the key management. You'll have to protect your private keys in order to prevent being compromised. As Kurt mentionned, it's perfectly fine to handle the KSK and the ZSK as stated.
But the experienced operational complexity for the 2 services is the following:
CA: The main tasks you'll have to achieve is the (re)issue and revoke certificate. These processes are rather simple because if you issue a wrong certificate just revoke it and issue a new one using your issuing certificate. If a service is disturbed, i.e. wrongly signed or invalid certificate, your service will be disturbed till the moment you'll put in place the new certificate.
DNSSEC: The main task to resign the zone (on time basis according to the validity lift time of the signed zone) and also re-sign when adding modification to your DNS zone. But if something goes wrong then your invalid DNSSEC zone will be cached in other DNS (i.e. clients, other companies) usually for 48 hours. As a example if your client are using google's DNS (184.108.40.206 & 220.127.116.11) your wrongly signed DNS zone won't be resolved trough google DNSs causing a huge service disruption. Your only chance will be to wait until your signed zone expires are other DNS will renew it.