How can I create a cluster that will use a private hosted zone for the internal assets (e.g. internal ELBs), but a public hosted zone for public assets (e.g. internet-facing ELBs) ?

The kops cli docs shows that you specify only one hosted zone and it could be either private or public - not both.