The QR-code based solutions, using elliptic curve asymmetric cryptography, aren't breakable by anyone at present (maybe someone has some monster quantum computer and they could, but they wouldn't be making fake vaccination certificates). The private keys could be stolen or misused of course, but there are very well proven solutions to that given how much of the industry relies upon asymmetric encryption and signing.

Originally the certificates were simple "yeah, they are vaccinated" PDFs that people would alter, which was a pretty low bar.

In discussions like this I think we really need to frame this in the proper context. We're talking about a certificate saying that you did something that you could do for free, which has significant personal benefits, and even greater social benefits, and that a large majority of the public is entirely behind. Making a fake vaccination certificate is like making a fake Grade school graduation certificate -- if someone is at that point in their life, something has gone seriously wrong.

The demand for certificates was just trying to entice the small percentage of holdouts, and of those surely there will be some who will go to great lengths, including committing pretty significant crimes, to avoid it. That pathology can't be fixed easily.