1. An apparatus for generating a digital image, wherein the apparatus comprises: an image generation unit for generating the digital image having a first security module which is adapted for cryptographically linking a first secret unambiguously identifying the first security module, and securely deposited therein, with the digital image such that the integrity of the digital image can be ascertained using the result of this first cryptographic linkage, the image generation unit comprising a processor unit that has implemented therein a normal runtime environment and a secure, trustworthy runtime environment, wherein the secure runtime environment is isolated from the normal runtime environment and serves for executing security-critical applications; and a portable data carrier which can be introduced into the apparatus, wherein the portable data carrier is furnished with a second security module which is adapted for cryptographically linking a second, different secret unambiguously identifying the portable data carrier, and securely deposited therein, with the digital image such that the identity of the portable data carrier can be ascertained using the result of this second cryptographic linkage, the digital image being signed using both the first and second cryptographic linkages to form a doubly signed digital image, wherein the integrity of the digital image and the identity of the portable data carrier are both identifiable using the doubly signed digital image.