DPI Deep Dive — Wednesday | November 04, 2026

Executive summary

This week the documents-and-data-exchange layer did two contradictory things at once: it absorbed more of the paper state, and it got stress-tested at both ends — the trust plumbing underneath and the API front door on top. On November 1–2, DigiLocker switched on registered land deeds for Assam through the national document-registration system (NGDRS), days after Karnataka’s October 17 Praja Seva order made DigiLocker storage and database-linked verification the default across citizen services. Digi Yatra began international passenger trials at seven airports on November 1 using e-passport-derived verifiable credentials — the document layer’s first border-adjacent production test — while domestic registration now runs on driving licences fetched from DigiLocker. Meanwhile the emSign certificate-compromise aftermath entered its cleanup phase: Chrome’s root-store removal took effect on October 27, eMudhra filed for a KPMG independent review on October 30, and its board had already voted on October 22 to exit the global TLS business — even as India’s certifying authority has still not publicly said whether it verified the “eSign unaffected” claim. And The Ken’s October 30 reporting laid out the layer’s front-door problem: AI agents are about to come for government records, API Setu — the audited marketplace built for exactly this — is six years old and underused, so the traffic goes through side doors where VAHAN data sells for ₹5 a record on Telegram. The layer is winning adoption faster than it is answering accountability questions.

Key developments

1. Land deeds go digital: Assam joins DigiLocker, Karnataka makes it the default

The week’s quiet landmark arrived on DigiLocker’s own channels: residents of Assam can now access, fetch and verify their Registered Deeds issued by the Office of the Inspector General of Registration, Assam, on DigiLocker — announced November 1 on Instagram and reposted on X on November 2, tagged #NGDRS and #LandRecords.¹² That hashtag matters: NGDRS, the National Generic Document Registration System run under the Department of Land Resources, is the “one nation, one registration” backbone for property registration, so this is not a one-off data feed but a state’s deed registry plugging into the national document-exchange layer. Registered deeds are the hardest document class DigiLocker has taken on — long-form legal instruments from state stamp-and-registration departments, not standardised certificates like driving licences or marksheets — and they are also the documents Indians fight over most: sale, mortgage, inheritance, mutation.

The state-level policy shift running in parallel is Karnataka’s. On October 17, the Praja Seva Department — in an order approved by Chief Minister D.K. Shivakumar and built on the Karnataka Administrative Reforms Commission-2 recommendations — directed departments to bring all citizen services online under Sakala: link systems to databases so citizens are never asked for documents the government already holds, update the Kutumba social-registry in real time, allow OCR-format PDF uploads, use officials’ digital signatures and e-Hastakshar for applicants, issue certificates on standardised EDCS templates carrying QR codes, shorten Sakala timelines, and automatically refund fees on rejected applications.³⁴⁵ Every certificate and licence issued to a citizen is to be stored in DigiLocker.⁴ The backdrop is scale: DigiLocker now counts over 73.53 crore registered users and 936.03 crore issued documents per PIB’s Global Fintech Fest factsheet.⁶

The consumer stakes cut both ways. The upside is real: a deed fetched in seconds is verified, non-forgeable, and removes the broker economy around “getting a certified copy.” But the shift is from “pull a document when a counter asks” to “the digital copy is the primary record,” and three risks travel with it. First, digital-by-default exclusion — Karnataka’s instruction to keep issuing certificates over the counter where possible is the mitigating clause to watch in practice. Second, digitisation is not accuracy: putting a deed on DigiLocker makes a wrong registry entry faster to retrieve, not correct. Third, the QR-coded template standardisation is the underrated item in the Karnataka order — an offline-verifiable credential format that could make “show me your certificate” checks work without an internet round-trip, if verifiers actually adopt it.

2. Digi Yatra goes international — with e-passport verifiable credentials, and DigiLocker as the on-ramp

On November 1, the Ministry of Civil Aviation began Digi Yatra’s international trials for Indian e-passport holders at seven airports — Delhi, Bengaluru, Hyderabad, Cochin, Mumbai, Chennai and Amritsar — running until December 2026 on select Air India and IndiGo international flights, with passenger feedback shaping a wider rollout in 2027.⁷ Enrolment is a four-step, phone-local flow: scan the passport’s machine-readable zone, read the embedded chip over NFC, capture a selfie for face matching, and store the resulting credential in the Digi Yatra wallet on the device. Once enrolled, passengers use it at terminal entry, security hold areas and boarding gates where infrastructure exists; immigration and airline checks remain unchanged. The domestic base this builds on is substantial — 26.5 million users and over 110 million journeys across 39 domestic airports, with 25 more planned by 2027.⁷

DigiLocker is the on-ramp for the domestic half of this stack: official Digital India channels spent the week publicising that passengers can register on the Digi Yatra app with their Driving Licence fetched from DigiLocker, and scheduled a November 4 “AskOurExperts” session with Digi Yatra CEO Suresh Khadakbhavi, who has tied future interoperability to IATA’s One ID and the ICAO Public Key Directory “while keeping passenger consent, privacy and security in place.”⁸

This is the document layer’s verifiable-credential architecture graduating to border-adjacent use, and two design choices deserve scrutiny. The credential is held on the device rather than in a central face database — a better starting point than most biometric borders. But face-as-token raises the stakes on consent granularity: what exactly is retained after a trial journey, for how long, and what happens to the December enrolment corpus when the trial ends. For the traveller, the practical position is simple: participation is voluntary, physical documents remain mandatory for immigration, and the privacy notice is worth reading before the selfie — trials are where data practices get set, not just tested.

3. The trust plumbing: emSign cleanup completes, KPMG review filed, and the regulator’s silence

The eMudhra incident that broke on October 17 — weak key generation producing instantly-recoverable private keys for eight emSign intermediate CAs — reached its main cleanup milestone this week. Google’s removal of the emSign ECC Root CA – G3 from the Chrome Root Store reached all devices relying on it on October 27, meaning legitimate certificates chaining to that root simply stop working in Chrome and on Android.⁹ The week then produced a second-order problem few consumers would connect to the certificates story: the 9,356 certificates eMudhra revoked on October 19 on its unaffected RSA hierarchy had been used by Indian government sites — including smart-city systems — which were left serving revoked certificates until someone fixed them; MeitY characterised the overall impact on Indian websites as “very limited and for a very short interval.”¹⁰

The corporate and governmental response stack is now assembled. On October 30, eMudhra filed its appointment of KPMG as the independent external reviewer of the incident, following its October 21 announcement of intent — the company has maintained that no end-entity certificates were issued through the affected intermediates, that its infrastructure was not breached, and that replacement certificates for affected customers will be arranged at no cost; its stock fell roughly 34% over three days during the crisis.¹¹¹² MeitY constituted a special team to investigate on October 21.¹¹

CERT-In’s advisory CIAD-2026-0050 (October 21, page updated as recently as November 4) gives the technical anatomy: two distinct businesses — the CCA-regulated DSC/eSign stack, and the international browser-trusted TLS/code-signing business governed by Web Trust audits conducted by BDO International. The compromised P-384 private keys had values smaller than 256 — recoverable almost instantly from their public keys — after a flaw in an April 30, 2025 key-generation ceremony produced a second, weak set of keys; eMudhra states none of the affected intermediates had issued end-entity certificates, only one was deployed in production, and no confirmed malicious exploitation had been established as of October 21.¹³

Here is the accountability gap that matters for this layer. The claim that India’s eSign and DSC services are unaffected rests entirely on architectural separation — different keys, different compliance frameworks — and that claim originates with eMudhra. As ThePrint reported on October 30, the government’s certifying regulator, the Controller of Certifying Authorities, has not said whether it has independently verified it; officials noted the failed business was audited by an international firm and that “MeitY is not involved in its audit.”¹⁴ The Internet Freedom Foundation has demanded an independent audit, and CashlessConsumer — the collective behind this newsletter — published its own public statement and open letter to RBI and MeitY on October 21, followed by a public-audit campaign on October 23.¹⁵ Meanwhile a reminder that document-layer abuse predates certificates: Hyderabad press reported this week (The Indian Mail, October 28) a cyber-crime case in which the accused allegedly gained unauthorised access to NIC’s DigiLocker, UIDAI online services and several banks by manipulating biometric and demographic records and creating forged electronic documents.¹⁶ The consumer takeaway is unglamorous but concrete: eSign still works because separation appears to have held — but trust does not run on assertions, and the one entity with statutory authority over eSign’s trust anchor owes the public its own statement.

4. The front door loses to the side door: API Setu, AI agents and ₹5 vehicle records

The Ken’s October 30 investigation framed the layer’s structural problem just as the government’s own agents prepare to walk through it. On October 16, MeitY hired CoRover — the GenAI company behind several government chatbots — to build agents that will fetch government records on citizens’ behalf.¹⁷ The mechanism meant for this access, API Setu, launched by MeitY in 2020 as the marketplace where ministries, states and companies exchange data through APIs, is six years old and still struggles to attract developers, data providers and departments: approvals are slow, and the catalogue has gaps. Centre and states are now setting up data governance committees to make government data more interoperable and accessible.¹⁷

Meanwhile, much of the actual traffic moves through side doors — one-off deals between a department and its vendors, each with its own terms and its own record of who took what. The costs are already visible: in September, the Internet Freedom Foundation reported a Telegram service selling vehicle owners’ names, addresses and phone numbers scraped from VAHAN and SARATHI, the government’s vehicle and licence databases, for as little as ₹5 a record.¹⁷ The Ken’s conclusion: AI agents accessing government data will face regulatory hurdles and “likely require explicit authorization beyond market access.”¹⁸ The irony was on display all month — MeitY showcased API Setu at IMC 2026 as the interoperability story of Digital India.¹⁹

For consumers this is the sharpest consumer-protection question in the layer right now, and it connects directly to DigiLocker: registration certificates and driving licences are exactly the documents DigiLocker issues as consented, verified, traceable shares — and the same classes of records leaked through vendor side doors for the price of a chai. The difference between the two flows is the difference between a share you consented to and a copy taken without your knowledge. The fix is not another platform. It is making the existing front door fast — time-bound API approvals, a published and complete catalogue, and audit trails a regulator can actually query. India’s DPDP consent architecture will mean little for government-held data if the working channels remain bilateral vendor contracts. Watch whether the new data-governance committees publish their mandates, and whether the CoRover agents are routed through API Setu — or quietly become another side door.

Cross-layer connections

Three threads tie the week to the rest of the stack. First, L3 to L1 (identity): credentials matured in both directions this week — Nagaland’s Home Department ordered all departments to accept Aadhaar App verifiable credentials as valid identity proof, with selective disclosure that shares only the fields a verifier needs,²⁰ while Digi Yatra’s international trial mints verifiable credentials from e-passport chips. Identity is becoming something documents do, not just something documents are. Second, L3 to L7 (trust and privacy): the emSign aftermath and the ₹5 VAHAN record are the same failure in different costumes — a cryptographic key and a database export both left their custodians because supervision was weaker than the value of the asset. The DPDP consent architecture only bites if the sanctioned channels are also the fast channels. Third, L3 to L6 (governance): Karnataka’s Sakala order quietly rewrites the citizen–state contract from “you bring documents” to “we verify against our own registries, in real time, with time-bound service guarantees and automatic refunds” — the document layer finally carrying a right-to-service promise, provided the over-the-counter fallback survives for citizens outside the digital default.

What to watch next week: the Controller of Certifying Authorities’ first public statement on the eMudhra incident — and KPMG’s terms of reference; how the Digi Yatra international trial expands through December and whether a privacy/retention note is published; whether other states follow Assam in putting registered deeds on DigiLocker via NGDRS; Karnataka’s Sakala rollout metrics — timelines, auto-refunds, over-the-counter volumes; and how the CoRover government-records agents are authorised — through API Setu’s front door, or a new side door.