Davao City Moves to Become First Local Government to Approve Its Own Digital Signature Certificates

By Kaeleb Savon Heck

DAVAO CITY, Nov. 5, 2026 — Davao City is moving to become the first local government in the Philippines to approve its own digital signature certificates, a step city officials say will end months-long waits that have left some official certificates expiring before they were ever issued.

The City Council on Tuesday, Nov. 3, authorized the mayor to sign a memorandum of agreement (MOA) with the Department of Information and Communications Technology (DICT). Under the deal, City Hall would become a registration authority under the Philippine National Public Key Infrastructure, known as PNPKI. The resolution was sponsored by Councilor Bonz Andre Militar, who chairs the council's committee on information technology.

If the agreement is signed, the city would be only the second organization outside the DICT to hold that role, after the University of the Philippines. It would also be the first local government to do so, according to Militar, as reported by Mindanao Times and SunStar Davao.

What a registration authority actually does

PNPKI is the government's system for issuing digital certificates, the electronic credentials that let a person sign documents online. SunStar Davao describes the certificates as a way to confirm who signed a document and whether it was changed afterward. A registration authority is the office that receives and processes applications for those certificates and checks the identity of the person asking for one.

Until now, the DICT has handled that job alone for the whole country. Davao City's own staff have only been able to help with the paperwork. According to the council's committee report, the City Archives and Records Office, known as CARO, can help employees fill out forms and verify their identities, but it then has to send every application to the DICT for approval. Under the MOA, CARO would be able to approve city employees' applications itself as long as they meet the basic requirements.

CARO proposed the change, Mindanao Times reported. Militar said the goal is to speed up approvals and prevent delays in signing important documents.

The waits, in the councilor's words

Militar told reporters after Tuesday's session that applicants used to wait for months. "Before, for example, when we applied for a digital signature, we had to wait for their approval, which would take months," he said in Cebuano, in a passage SunStar Davao translated into English.

He offered the mayor's own certificate as an example. It took months, was still not approved, and then expired, he said.

The delays sit awkwardly beside the DICT's own written standard. SunStar Davao reported that DICT policy says a certificate should be issued within five calendar days after the applicant's identity is verified. Militar blamed the backlog on a lack of personnel at the DICT. Neither the council nor the DICT has released figures on how many Davao applications are pending or how long they have actually taken, so the scale of the backlog is known only through the councilor's account.

Certificates are valid for up to two years, and holders must reapply in person each time, SunStar Davao reported. That means a slow approval process does not just delay a first signature. It can repeat every two years for every employee who needs one.

Why city offices care

Digital signatures are already common in Davao City Hall. The committee report noted that most heads of city offices already have them, and that they matter most for priority services such as permits and licenses, where officials sign a large volume of documents. Mindanao Times reported that the signatures let officials sign batches of documents with a single approval, which is a significant time saver when the same people approve hundreds of items.

A PNPKI signature is not the same as a scanned picture of a handwritten one. According to the committee report cited by SunStar Davao, it is tied to the signer's DICT-issued identification, carries a time stamp, and disappears if the document is altered. Mindanao Times, citing the DICT's description, said PNPKI is meant to provide four guarantees in every signed document: authentication, confidentiality, integrity and non-repudiation. In plain terms, that means the system is meant to show who signed, keep the content private when needed, prove the document was not changed, and prevent the signer from later denying that they signed it.

Security questions the council asked

Because a registration authority is the point where identities are checked, council members raised security during committee discussions. Officials confirmed to the committee that no security breaches or data compromises involving PNPKI digital signatures have occurred since the system was first deployed in Davao City, Mindanao Times reported. Militar said he asked the DICT during the hearing how many data breach incidents had occurred since PNPKI began, and was told there had not been a single one, according to SunStar Davao.

Those statements come from officials, and the reports do not describe an independent audit. They should be read as the DICT's and the committee's own account.

Background: how the university got there first

The University of the Philippines became the first registration authority outside the DICT on May 13, 2026, according to the university's Office of the Vice President for Digital Transformation. The arrangement rests on a three-year agreement between the DICT and the university signed on July 21, 2025.

The university's release said PNPKI was established under Executive Order No. 810, signed in 2009. It said more than 30 information technology and human resources employees across the university's campuses completed a three-day registration authority training on Sept. 23 to 25, 2025, and then received cryptographic tokens after finishing the DICT's qualification process. Those officers can verify identities, enroll applicants, process certificate applications and handle revocation requests for people in the university community.

At the 2025 signing, UP President Angelo Jimenez said that becoming a registration authority "enables us to manage digital certificates internally, and at the same time eases the administrative burden on the DICT," which he noted was then the only registration authority in the country.

The university's timeline offers a rough guide to what Davao City may face. Its agreement was signed in July 2025, its officers trained in September 2025, and its authority went live in May 2026. Davao City has not published a timeline, but Militar said training will follow once the mayor signs.

Analysis: speed is the promise, verification is the job

The case for the change is easy to see. A city that issues thousands of permits cannot keep its signing officials waiting months for credentials. Moving approval inside City Hall removes a hand-off to a national office that, by the councilor's account, is short of staff.

But approval authority is not just a faster queue. It is a trust role. The registration officer is the person who confirms that an applicant is who they claim to be before a certificate is issued, and a certificate that carries the force of a signature is only as reliable as that check. The University of the Philippines required formal training, a DICT qualification process and hardware tokens for its officers. Whether Davao City's CARO staff will meet the same standard, and how the DICT will oversee them, are details the public reports do not yet answer.

There are other open questions. The reports do not say how many city employees need certificates, what the city set aside to pay for the program, or whether the arrangement would ever extend beyond city employees to residents or businesses. Militar said funds have been allocated but did not give an amount.

For residents, the practical effect would be indirect. If the program works as described, permit and license documents would be signed faster, and expired credentials would be less likely to stall a document that is already in the queue.

What's next

• The MOA signing: Implementation begins once the mayor signs the agreement with the DICT, Militar said.
• Training: Employees are to receive orientations and training after the signing, supported by an allocated budget for infrastructure, according to Mindanao Times.
• Details still missing: The budget amount, the timeline and the DICT's oversight terms have not been made public in the reports reviewed here.
• Wider ripple: If Davao City goes first, other cities that complain about similar delays may ask for the same arrangement, though no other local government has announced such a plan in the sources reviewed for this report.

Sources

• SunStar Davao, "Davao City first LGU to approve digital signature applications," Nov. 4, 2026: https://www.sunstar.com.ph/davao/davao-city-first-lgu-to-approve-digital-signature-applications
• Mindanao Times, "Davao City to serve as registration authority for digital signatures," Nov. 4, 2026: https://www.mindanaotimes.com.ph/davao-city-to-serve-as-registration-authority-for-digital-signatures/
• University of the Philippines Office of the Vice President for Digital Transformation, "UP activates country's first University PNPKI Registration Authority," May 13, 2026: https://ovpdx.up.edu.ph/up-activates-countrys-first-university-pnpki-registration-authority/
• University of the Philippines, "UP adopts DICT's public key infra to strengthen e-signature policy": https://up.edu.ph/up-adopts-dicts-public-key-infra-to-strengthen-e-signature-policy/