I recently did a write up [1] of the Lithuanian vaccine certificate after finding a flaw on it.

What impressed me was that the verification was done fully offline in a privacy preserving way

[1] https://tadas.varanauskas.lt/posts/forging-lithuanian-vaccin...