I implemented a pseudonymous PKI scheme (by K. Zeng @Springer Link), where all peers can change their public keys including its signature on their own. I am looking for a way to extend it with some authorisation functionality in that way, that an Authorisation Instance can provide specific credentials to a peer. (e.g. give their message credibility, or allow some special message types). Since such a credential could be linked with the identity of the peer, it also should be renewable without the reinvolvment of the Authorisation Instance. Some of the peers only us local communication and, therefore, are not able to contact the Authorisation Instance or the CA.
The papers I read so far, only offered interactive solutions in the form of a challenge response or required the involvement of the Authorisation Instance again. Maybe I searched for the wrong keywords.