In a good modern implementation, it should be extremely hard to produce a physical card with an authenticated pointer to the database, because that would be als

In a good modern implementation, it should be extremely hard to produce a physical card with an authenticated pointer to the database, because that would be also signed. But considering that they've been retiring things like biometric residence cards in favour of web-based systems, it's possible there will be no physical component.