> What kind of bullshit does it do?
It doesn't utilize a hardware-backed secure secret storage on Android (~80% of marketshare in EE if I remember correctly). This means vital key material is unsafe from any compromise, just a plain file somewhere. This means that they have to go into a lot of effort to detect clones, which is also certainly not infallible. Cloning or compromising an ID-card of Mobile-ID is way way harder with it's audited security.
The technical overview describes how key is generated on the device and half of it is sent to AS SK's servers. There's no security benefit in that (they can't really verify you've deleted their half of the key from your device), except that now AS SK has half of your private key. In general their technical overview gives the feeling that like they want to pull wool over people's eyes, it's IMHO a bad sign.
It also totally lacks any privacy, every login you do is logged and counted. SK AS shouldn't mandatorily have that metadata.
It relies completely on their centralized servers, they go down, your authentication and signing goes totally down. Neither service owners or their clients can do anything about that. Identity mustn't be like that.
It's totally proprietary, thus their claims about security can't be easily verified, and it's limited to their blessed OSs (and versions). If they go bankrupt or similar, the identities of all those people are in jeopardy.
It's also expensive for server administrators and thus has a high barrier of entry. Identity and security shouldn't be behind a paywall for neither side. The web has LetsEncrypt and now a lot more sites are protected, the web is better off, SK AS has done the opposite.
In comparison, ID-card's PKI is usable for free, supported in every system (that can do TLS basically), entirely FOSS if you wish, the hardware is much more secure (EAL6+), it doesn't mandatorily leak metadata, doesn't rely on a centralized proprietary server to work.