What I read was they were seeing fake certificates - but these could be created by compromising the vax registration application and certificate download proces

What I read was they were seeing fake certificates - but these could be created by compromising the vax registration application and certificate download process. It could be done by compromising a vaccine clinic tablet and issuing new records into the main WHO CoVAX record database under arbitrary names, and then collecting the fake passport image from the web interface citizens use. I don't think you need to compromise the root certificate or signing keys to do this, there are easier ways. (But if I could put in a request for a Josef K., and an A. Solzhenitsyn novelty certificate, it would be a nice to have on my phone.)