I looked into it a little more, and it's even more dubious than I originally thought. To first address your questions: they claim they only get the document si

I looked into it a little more, and it's even more dubious than I originally thought. To first address your questions: they claim they only get the document signer certificate from the security object in the document. This in itself isn't dangerous but if they can read this file, they can also read files which do contain privacy sensitive information. More than enough to be very worried about identity theft. Even more more worrying is that they treat having the document signer certificate as proof of holding a passport. This is not in any way a proof of you holding a specific passport. Document signer certificates are not unique to a document, and even if they were it doesn't prove in any way you're not using a copy.