* As far as I know upon cert renewal the new cert is generated on your computer, uploaded to the card and then deleted - you could theoretically intercept that but I don't see why you would - the key is more secure on the card
* The state-approved certs one is for e-identification (when PIN is entered also authentication), other for signing (AFAIK not RSA but EC)
* See point one
* Encrypting data can be done but as the software warns, it's to protect the data during transit not when idle and nothing is stopping me from using the card daily to log into my bank and other services I need to use
* The key is stored on the smart card but you can get multiple (AFAIK at least for e-identification).
Don't know much about the Estonian PKI infrastructure though and it seems stable enough for daily use without any noticeable hiccups.