Thank you for the response.

1) yes. I've downloaded the certificate from the https://get.dgc.gov.it/v1/dgc/signercertificate/update website, in here you can find the duration of the certificate, I don't know if does exist an automatic mecanism for updating the certificate

2) The keys are exposed on the API so that anyone can access them, I think that the url is the best way.

3) No, I don't think so.