[namibj]

German id cards essentially record the newest issuance timestamp seen; then they block certificates that expired prior to this recorded value.

[cperciva]

So one erroneously issued certificate can brick every ID card in the country?

[ACCount37]

Pretty much. But you would need, first, to issue a valid certificate with a timestamp far ahead in the future. And then expose every ID card in the country to it.