When producing a QR code, the signature could include the date that the QR code was generated, and the date that the phone was biometrically linked to the user (signed by a device-specific key in the secure enclave, itself signed by the manufacturer's key).

Venues could then require that you were using a phone that had been soul-bound to you since before the tickets were first available for purchase.

(For the avoidance of doubt, what I'm describing here is the basis of an Orwellian dystopia, not something that I think should ever be implemented.)

Even Costco has self-modifying barcodes now, so covid vaccination passes are behind on the times.