CIRA has 3 levels much like opendns, private, protected and family. My router has already been using private for awhile mainly because it was the fastest dns.
The server for where I am located is hosted at a local ISP. If they were truly nefarious vacuuming up every dns request and providing a printout of my activity to the prime minister every morning they'd just host the server on their own network.
If CSE built it themselves as alleged, they did a good job in terms of its performance and I trust the Canadian government more than I trust an ad company.