One solution for the ECDSA case is to have the owner sign with the key a+b (that is adding the private keys together mod the order of the curve).

This is straightforward to verify since the public key is also A+B (that is adding the public keys together).

For the RSA case, you should be able to do something similar if the public exponent is the same for both. Let the one public key be $(e, n_1)$ and the second $(e,n_2)$, then you can create a multi-prime rsa key with public key $(e, n_1n_2)$. Using such a large key will be expensive. Hopefully someone else can find a nicer solution.

One solution for the ECDSA case is to have the owner sign with the key a+b (that is adding the private keys together mod the order of the curve).

This is straightforward to verify since the public key is also A+B (that is adding the public keys together).

One solution for the ECDSA case is to have the owner sign with the key a+b (that is adding the private keys together mod the order of the curve).

This is straightforward to verify since the public key is also A+B (that is adding the public keys together).

One solution for the ECDSA case is to have the owner sign with the key a+b (that is adding the private keys together mod the order of the curve).

This is straightforward to verify since the public key is also A+B (that is adding the public keys together).

For the RSA case, you should be able to do something similar if the public exponent is the same for both. Let the one public key be $(e, n_1)$ and the second $(e,n_2)$, then you can create a multi-prime rsa key with public key $(e, n_1n_2)$. Using such a large key will be expensive. Hopefully someone else can find a nicer solution.