[cperciva]

So one erroneously issued certificate can brick every ID card in the country?

[ACCount37]

Pretty much. But you would need, first, to issue a valid certificate with a timestamp far ahead in the future. And then expose every ID card in the country to it.