Starting your own CA would be pointless for those outside of the DPRK. It would get labeled as being used by "authoritarian regimes", the technical people for Chrome, Firefox, Edge would ask why they should add it and act like it's going to be used for nefarious ends and probably refuse to add it to their certificate stores.

Without that and without a state-distributed operating system or state-browser bundle you can distribute to people with it pre-installed everyone would have to install the CA root, trust it in their browser, etc. And most people aren't going to do that they're just going to see the scary untrusted cert warning and back away from the website. Them adding untrusted CA generated certificates would literally hurt their ability to get people to look at them.

Knowing very little of the specifics, it would be trivial for the DPRK to set up their own CA. They probably do have a CA. The issue is that Western software distributors (operating systems, browsers, etc) probably wouldn't want to include DPRK CAs in their CA stores. Likewise, organizations within the DPRK probably don't trust CAs located in the West, even if they are operated by nominally allied organizations. This problem can be solved by including their domestic CAs in software distributions (they have their own Linux distro, after all) and distributing tools to easily install them on other operating systems.

Do you know if this applies just to outward-facing websites, or is this a problem across the board on their domestic networks?

Voice of Korea does in fact have a TLS certificate. You may have to specify https:// manually though.

It's still going to make western web browsers mad because It's technically self-signed. Also it expired almost 2 years ago.

There's not much you can do except advocate for the use of DANE in browsers: this lets site operators pin their certificates in DNS. It is tricky because it is linked to the operation of DNSSEC at the moment. Have a read:

https://en.m.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities

Websites in the DPRK's intranet have access to SSL certificates. Their root CA for all websites within the DPRK is the Pyongyang University of Science and Technology if I'm not mistaken. They also issue certs for their own websites on the internet.

The next step, in this situation, is pushing for certificates from sanctioned countries to be included into free software web browsers. I'd even argue that forking Firefox just to do this is justified, though supporting an up-to-date fork is no easy task, even for small changes like changing the default cert store.