which 2 letter TLDs are not controlled by states?
But then there's .io (and a few others: .ac, and previously .sh, .tm) where they were actually delegated to a British guy and are now controlled by the private company he started. And according to the British government, they have no agreement with the company, and they receive no revenue from the domain registrations.
There are a bunch on there that I wouldn't consider states, e.g. both UN/EU are exceptionally reserved and have `.un` and `.eu`. Antarctica also has `.aq`.
The Heard Island and McDonald Islands has `.hm`, and it's not a state (since it has no population) but I guess it is controlled by Australia.
I said available for private use.