Most people who use ID card every day have updated certs remotely or went to police office. I would say government handled it pretty well.

Problematic was communication with card maker Gemalto, who didn't inform Estonia about security flaws properly. Gemalto was informed by researchers in March. These researchers informed Estonian government in August. Few days after that prime minister announced security problems.

Things would have been a lot of easier if Gemalto didn't hide the problem from the government.