Can't you just show the paper with the proof of vaccination? Like I might not have a smartphone but I have the paper and ID card in my wallet.
If it even matches the source as is. Play Store and App Store are non reproducible.
Obviously there's a risk that the person scanning the QR code does shady things with it but it's rather unlikely the app itself will. It would be caught really quickly.