Indeed I was about to write as you have that key servers, or CT logs etc could arbitrarily decide not to include whatever keys they wanted -- although once included, it would be a pain to get rid of them because I think they're built on a Merkle tree structure which is routinely audited: I believe revoking a key doesn't actually delete a key from the database, but rather adds the statement "this key is now revoked", as it's an append-only ledger.
In theory the miners of a public blockchain could also do such auditing, to simply decide to ignore anything containing child pornography, just as they could arbitrarily decide to ignore any transactions. Of course, it's probably expensive to actually check all possible transaction in this way, and they most likely don't have a big enough incentive to. And of course for other sometimes illegal content (e.g. a picture of Mohammed or a particular nation's state secrets) some group of miners would censor while some wouldn't, and it would only take the miners who don't censor to win once for it to forever fork the blockchain.
In theory the miners of a public blockchain could also do such auditing, to simply decide to ignore anything containing child pornography, just as they could arbitrarily decide to ignore any transactions. Of course, it's probably expensive to actually check all possible transaction in this way, and they most likely don't have a big enough incentive to. And of course for other sometimes illegal content (e.g. a picture of Mohammed or a particular nation's state secrets) some group of miners would censor while some wouldn't, and it would only take the miners who don't censor to win once for it to forever fork the blockchain.