There are a significant number of ways to do it correctly. I personally would like one, but not centralised, but some form of completely anonymous time-limited digitally signed vaccination YES/NO/DAYS SINCE COMPLETED/TYPE and nothing else. Constantly morphing QR, only valid for a few minutes, prevent transferring via screenshot or passing a phone since it's invalidated after scan, whatever else.

I would be glad to show something like that to every store and restaurant - I explicitly do not want to give ANY store my phone number or any other information at all. I explicitly WISH TO tell the store that I am vaccinated with Moderna as of 2 weeks or more ago.

There are ways to do it reasonably correctly, but local bureaucratic bullshit will happen and what will appear is some kind of online-only spyware app that contains PII/PCI data encoded into your QR code.