Thanks for the comment! Good catch--I think you're right about the SMART Health Card spec, but the concern is whether the spec will be implemented in a way that prevents aggregating and sharing of data. EFF did a great article looking at the concerns with data being aggregated by third parties, or potentially by a state app, even if the spec itself only provides for signing.

https://www.eff.org/deeplinks/2021/06/decoding-californias-new-digital-vaccine-records-and-potential-dangers