The EU explicitly wants countries to join. The EU-DCC is designed to be an international system - lots of EU countries already had domestic systems, so we focus

The EU explicitly wants countries to join. The EU-DCC is designed to be an international system - lots of EU countries already had domestic systems, so we focused the design explicitly on being a state-verified (and managed, and policed) proof of vaccination. Only States can sign the EU-DCC, and to do so they must meet various standards for security (proper key management, opsec, HSM, crypto strength). They must also agree to accept the EU-DCC of all other member countries, and respect privacy. And police their systems (identity and arrest frauders). All pretty standard things, and a great complement to the systems used domestically. Having a state provide an abstraction layer of their local issuers is super effective - how can you expect an American state to do quality controle on a Russian pharmacy who are signing a Smart Health Card? They have to invade Russia to police it?