According to a joint statement from Altron Security and the Zambia Information and Communications Technology Authority (Zicta), a production key ceremony in Lusaka on 20 August marked the activation of Zambia’s national root of trust, the cryptographic foundation needed for a sovereign digital identity system.
The ceremony, overseen by a notary and independently audited, saw the root keys generated in a purpose-built secure facility and split between custodians so that no single person holds the complete material. Zicta now acts as the country’s national root certification authority, the entity that issues and verifies digital certificates.
Digital certificates are the internet equivalent of a passport office: they prove that a person or service is who it claims to be. The technology, known as public key infrastructure (PKI), is essential for any government that wants to issue a digital identity that other parties can trust.
Namibia followed eight days earlier, with its Communications Regulatory Authority (Cran) holding a key signing ceremony on 28 August and launching its national PKI, branded DigiNam, on 31 August. Like Zambia, Namibia’s PKI is state-run and backed by its Electronic Transactions Act.
South Africa, by contrast, has a policy framework, draft regulations and a presidential promise, but no commercial deployment of a national PKI. Under the Electronic Communications and Transactions Act of 2002, the South African Accreditation Authority accredits private providers, Altron Security, TrustFactory and Impression Signatures, to issue advanced electronic signatures. The country therefore delegates the root-key function to commercial operators rather than holding it in state hands.
Altron Security, a JSE-listed subsidiary of the Altron group, won the Zambian contract through a public tender three years ago. Its managing director, Andrew Whittaker, told TechCentral that the technical work is only the first step; after twelve months the system must pass an international WebTrust audit, which checks whether the authority runs in line with its own policies.
Whittaker also hinted at future opportunities, saying Altron sees repeat business across Africa and is looking for more sovereign trust projects. He declined to comment on whether Altron would bid for South Africa’s Home Affairs certificate authority, noting he was not aware of any current tender.
Local experts caution that building the infrastructure is only the beginning. Percy Chinyama, national coordinator of the Smart Zambia Institute, warned that institutions could become dependent on suppliers if they lack the staff to operate the system. He stressed that the value of the national PKI will depend on sustained funding, skill development and institutional readiness.
South Africa’s own digital identity roadmap, outlined in the Department of Home Affairs’ annual performance plan, envisions a PKI, a certificate authority, an identity platform, verifiable credentials and biometric wallets. The plan targets completion of the hosting infrastructure inside the SARS environment by 31 March 2027, with a rollout in 2027/2028. Draft amendments to the Identification Regulations, gazetted on 4 May, introduced a smartphone-based digital identity called MyMzansi, but no commencement date has been set and the National Identification and Registration Bill is not expected in parliament until 2027/2028.
The contrast between the state-run models in Zambia and Namibia and South Africa’s reliance on private providers raises a strategic question for South African policymakers: does delegating the root of trust to commercial entities slow down deployment, or does it offer flexibility and lower upfront cost? The answer will shape how quickly South Africans can access secure digital services such as online banking, e-government portals and health records.
For small and medium-sized enterprises, the pace of PKI deployment matters because many digital contracts and e-signatures depend on trusted certificates. A delay in establishing a national trust layer could mean continued reliance on foreign or ad-hoc solutions, which may be more expensive or less secure.
