Whenever you present a certificate to the passport, its current time is updated by the "valid from" value if it's newer then the current time.
It's not perfect but if you started you trip in another country with such a system and where a more recent certificate was used, your passport will deny access.
Passports don't know the current time and thus can't tell whether the presented certificate is within its validity range (as in a malicious attacker could feed an expired certificate as well as a fake "current time" value to make it appear valid), so why are those certificates short-lived?