No photos on the UK NHS covid pass (well not on the "domestic" non-travel one anyway), just name, date of birth, 30 day expiry date, and a QR code. And the option to add it to the Apple Wallet in an even plainer and more basic form, ripe for screenshotting and sharing. Maybe the idea is you are supposed to show photo ID alongside it, I don't know, nor do I know what info is in the QR code or what equipment venues are supposed to have to scan that QR code. But anyway all they did at Winter Wonderland was glance at the phone screen and wave us in.
When I worked for a supermarket I had a discount card I could store on my phone and even that was more secure just by having the date/time on the "card" and a little animated logo in one corner that was constantly changing colour thus showing in an instant that it was not a screen shot.
Just seems like lunacy, the NHS has thrown millions if not billions into this covid pass and the related procedures and you can just bypass the whole thing by screenshotting and sharing.