My understanding is that health care professionals do not directly interact with the system generating certificates. Instead, they simply enter patient vaccination records in e-health system (or whatever it is called in each country). And then the certificate systems query patient's records and if appropriate information is found, generates a certificate. Clearly, there is no patient with such a name and date of birth which means that someone has tampered with the certificate generation system directly. Even if the keys are not stolen, someone might have an unauthorized access to the system at high level.