The verification app needs to maintain a set of trusted certificates. More details on the trust model can be found here: https://github.com/ehn-dcc-development/hcert-trust/blob/main...

Infrastructure for code generation and signing is probably country-specific, though I imagine most countries will establish centralized systems dealing with this and integrate with other systems that track vaccination or test records on various levels (some countries delegate vaccination efforts to their states, others handle it nationally, etc.)