That makes sense. It has been almost a decade ago when I worked on this subject. Do you have examples of countries that do this?
Some countries (like Belgium) this _is_ a goal. They implemented a full PKI in their identity cards.
Some countries (like Belgium) this _is_ a goal. They implemented a full PKI in their identity cards.
Essentially, these countries run two applications on the document chip: One that lets anyone verify the authenticity of the document, using the ICAO PKI and active or chip authentication, and one that lets the document owner sign data, usually after entering a PIN or password (or anybody holding the document could do so on their behalf).
Other countries decouple e-signatures/remote authentication and electronically verifiable identity documents, e.g. Austria – which now has an ICAO-compatible identity card, but a completely separate e-signature schme based on, and it really pains me to say this... server-side private keys.