To add onto what eadmund wrote, militaries need to control their own CAs, lest critical systems become disrupted due to the revocation of their certificates by

To add onto what eadmund wrote, militaries need to control their own CAs, lest critical systems become disrupted due to the revocation of their certificates by civilian CAs who were hacked (including physical or employment infiltration) by a foreign military. In order to secure military systems, the military would then have to take over the civilian CA, either formally or informally (by defining standards and dictating employment), which is a non-starter. Militaries further do have the resources to manage their own CAs internally, so the cost of running their own CA is a non-issue. Public companies don't typically have "our CA getting hacked by a foreign power in a war affecting all our traffic" as a part of their threat model, which is why public companies can use public CAs without worry.