Ring-Signatures, as proposed by Rivest, Shamir, Tauman, provide means to make sure a signature stems from one secret key out of an arbitrary amount of public keys without requiring the owners of the latter to even consent. Obviously one could try and hide a spoof key in a large list of valid keys of a renowned organization in an attempt to claim an authorized message where none is. So in order to increase the trustworthiness of such a ring signature, I'd like to add additional information with the following requirements:
- It allows all potential signers to identify the true signer (in the simplest case this would mean the signer's public key were encrypted to all other signers' keys)
- Anyone can verify that all signers can identify the true signer without means to do so themselves (which rules out simply encrypting the true signer's key since then one would just have to check which public key encrypts to the given ciphertext)
- Even though the other signers can identify the true signer, there is no way for them to unveil this to anyone else. This might be weakened into e.g. they could at least proof it was not themselves
Does such a scheme exist? Or is this impossible?