It's actually done this way. Back in 2014 there were basically two ways to get the public certs. Donwload them from each government site individually or use th

It's actually done this way. Back in 2014 there were basically two ways to get the public certs. Donwload them from each government site individually or use the only PKI infrastructure available for this task which was pretty expensive and did not have all certs either. And as far as I recall signatures were only checked for being signed by a valid key not if the key matches the country of origin. So someone in country A could sign a forges passport from country B (but not 100% sure on that anymore)