As another data point, I got my Chave Móvel Digital with just a UK passport plus a PT mobile number & NIF last month. Like many of you, I’m still waiting for my GV approval and residency card 
It’s debatable whether the CMD is worth getting. I wanted one to be able to follow the status of a Livro Amarelo complaint, but it turns out only complaints associated with a Citizen Card can be tracked online!
I’m on Madeira, so went to the Funchal Lojas de Cidadão (Av. Arriaga 42a) to apply for my CMD. Some tips that may help others:
- Initally I took a queue ticket for ‘Citizen Card / Chave Móvel Digital’ - but when I got to the counter the lady said this was only for Citizens
- I then took a queue ticket for ‘Balcão Cidadão’ (Citizen Service Desk 4 in Funchal), where there was a hand-made sign in English regarding the CMD (below), so I knew I was finally in the right place (despite not offically being a ‘Citizen’)
- I was served after about a 20-25 minute wait. Rumour in the queue was if you visit closer to mid-day there are typically 2 Balcão Cidadão counters open instead of just 1 so it’s faster - I can’t confirm/deny
- The Agent didn’t/couldn’t add my NISS (as suggested above), just my UK passport + NIF
- You are assigned a temporary CMD PIN. The Agent had me change that to my own PIN at the counter
I had hopes that the Chave Móvel Digital would be a more secure authentication method. By default the CMD system sends you a code (different from your PIN) via SMS when you use it to log into a PT site. You can change that to only send the code to a Gov.pt app on your phone that uses biometrics.
…all good, but many government login screens also have an option “If you haven’t received it [via the App], click on Send by SMS”. So the same SMS vulnerabilities like SIM Swapping/Hijacking and SMS Interception apply even if you’re using the Gov.pt app with biometrics!
