Consider the following (probably naive) scenario.
Alice, who is very limited in her knowledge of security in general (clueless about securing a private key for example), wishes to delegate certain contractual operations to Trent, an apparent trusted expert in that field.
However, Alice is rightly cautious and is of the opinion that Trent could be compromised (by Eve or Mallory) and so she asks Trent to provide a number of substitutes (Steve, Sam and Sarah) who can fulfil the same role as Trent (if he is away) and also make sure that Trent remains trustworthy (by observing his behaviour). Steve, Sam and Sarah cannot request to talk to Alice directly since all communication directly to her is through Trent.
Fortunately, Alice is protected by Walter, who she trusts completely, who is able to convert her simple password-like authorisation into a one-time only authorisation that Trent, Steve, Sam and Sarah can all see and verify.
From the above, it is apparent that in the normal situation when Alice requires a contract to be issued she provides Trent with the basic details, along with her authorisation via Walter. Trent creates and signs a contract on Alice's behalf (first problem) and then appeals to Steve, Sam or Sarah to counter-sign. Steve, Sam and Sarah all check Trent's public record of contracts to ensure that he is not exceeding agreed boundaries (second problem) and, after checking with Walter, sign if everything is OK. Once all signatures are in place then the contract is valid.
However, problems arise in the abnormal situations when Mallory enters the scene. Mallory may attempt to create a contract by taking Alice's authorisation and altering the provided details. Equally, since Trent is able to create arbitrary contracts, perhaps Mallory could create one that does not require Steve, Sam and Sarah to counter-sign but still appears to originate from Alice.
So my question is this: how can Alice ensure that her contracts can only be issued with her express permission without alteration, but still allow her to delegate the mechanics of this operation to others?
Please forgive the rather basic approach, I imagine that this scenario has been solved, but I'm not sure where I can find the details. Also, there are probably gaping holes which I would appreciate a more experienced eye pointing out.
It can be assumed that a contract requires a private key associated with Alice to enforce non-repudiation. However, if that private key could be hidden from both Trent and Mallory, perhaps by distributing it around Steve, Sam and Sarah that would be extra protection for Alice.
A real world example
The above is a rather generalised version of a problem that has arisen in the Bitcoin SE site (see http://bitcoin.stackexchange.com/q/517/117 for some interesting approaches) but has wider appeal than Bitcoin. However, using Bitcoin as a real world example may help clarifying some of the problems.
First, a quick overview of Bitcon. Bitcoin is a cryptocurrency that uses transactions to indicate a change in ownership of the underlying amount. It's not necessary to understand how this works, other than that a cryptographic signing protocol (elliptic curve DSA) is used to enforce non-repudiation. This signing protocol requires a public and private key.
So, to the problem. Given that Bitcoin is intended to provide a general-purpose replacement for cash it will be used by mainstream (non-technical) people - Alice in the above scenario. The vast majority of these people will want to delegate the security of their private key to someone who has put in place strong security measures, and use a password or OpenId type authentication and authorisation process (Walter).
Those people in charge of the private key (Trent) have the ability to create arbitrary transactions. Assuming those people are never compromised all is well. However, there have been many cases where servers have been hacked and keys stolen. As Bitcoin grows so that, for example, high value international trade with suitable escrow becomes a reality then the possibility for intimidation arises (force the owner of the escrow company to copy all the private keys across to Mallory). This is another attack vector to the private key. Since Bitcoin transactions are non-refundable, once the private key is lost all hope of retrieving the bitcoins is lost - it will be very hard for a legal system to help you recover the funds.
An approach to combat this is some form of shared trust protocol so that any single operator does not have full access to the private key. Instead a random group (or federation) of co-operating, largely trustworthy, operators can collaborate to construct the key and then use it. This protects each individual operator (the Trent's) from intimidation because they have no control so it's useless to expend effort compromising or intimidating them.
It might be possible to use oblivious transfer in some way, but I am not sufficiently versed in this area to comment.