External key generation could still make sense as Estonian ID card were suspectible to the Infineon bug. One workaround to that bug would be generating the key

External key generation could still make sense as Estonian ID card were suspectible to the Infineon bug. One workaround to that bug would be generating the key in software and putting it on the card. (I'm not saying that's the case, but merely that it may make sense.)