Security concerns raised about third-party proof of vaccine apps