OP here. I’m still unsure about one assumption and would love pushback:

Even if the cryptography is solid, is asking doctors to scan a QR code already too much friction?

If you’ve built tools for clinicians, what’s the maximum workflow change they’ll tolerate?