Well, yes. The only privacy concern I see is when online services ping back to the Estonian government to make sure your certificate hasn't been revoked. If they choose to hit their API for every public key they encounter, the government could collect information about all the services you use. I think businesses can choose to periodically download a list of revoked certificates instead to avoid leaking usage data.