For a PKE scheme $(Gen, Enc, Dec)$, the most 'obvious' idea is to commit to an encryption of a bit and in the reveal phase maybe send $r_g$, $r_e$ where $r_g$ is the randomness of $Gen$ and $r_e$ is the randomness of $Enc$.
However, if the encryption scheme is not perfectly correct, then maybe there is some $sk, sk'$ such that $Dec(sk, c) = 0$ and $Dec(sk', c) = 1$, so binding fails, because we can fiddle with $r_1$.
A solution is to only reveal $r_2$, and then in revealing one only needs to check that $Enc(pk, b, r_2) = c$. Particularly, if the probability over $Gen$ that there exists some $r_2, r_2'$ with $Enc(pk, b, r_2) = Enc(pk, 1-b, r_2')$ is negligible, then this almost works. However since the sender doesn't have to prove what $sk$ they used, we can still break binding.
How can we get around this issue in the CRS model?