As far as I understand it, the main problem / risk is not that it's an eID system (which many EU countries already have), but that government CAs are being introduced into browsers and devices without the possibility of removing them - even if those CAs don't conform to current CA standards like certificate transparency.

We already have CAs from e.g. the German Bundesdruckerei in trust stores, that's not new, but those can be distrusted, if one wants to. The law may disallow this, and those CAs can be used to e.g. MitM TLS connections.

See: https://blog.mozilla.org/netpolicy/files/2023/11/eIDAS-Indus... and https://nce.mpi-sp.org/index.php/s/cG88cptFdaDNyRr