I was wondering if there is any kind of cryptosystem where the following characteristics are met:
- Both public and private keys are generated by a two-party key generation protocol between a user and a Certificate Authority/Key Generation Center/Whatever.
- The user cannot create valid (i.e., "certified") key pairs on his own. In other words, it is not possible to produce ciphertexts under his public key nor to decrypt ciphertexts unless the protocol has been followed.
- There is no key escrow (i.e., at the end of the protocol the CA does not know the private key)
- The CA cannot decrypt messages either.
It reminds me to Certificate-based Encryption (CBE), except that in this case the public key is also produced by the two-party protocol, so CBE would not satisfy requirement 2.