If the ID card cryptographically signs it, doesn't that mean that it isn't anonymous? I assume it's a variant of PKI, with everyone trusting the government's r

If the ID card cryptographically signs it, doesn't that mean that it isn't anonymous? I assume it's a variant of PKI, with everyone trusting the government's root key, and each ID card storing a unique certificate signed by that root key. But an ID card will only have a single certificate, so it would be trivial to see that multiple data snippets were signed by the same certificate - and therefore the same person. That would allow a website to track users across sessions - or even across websites.