Writing this as a serpate answer, but it goes along fgrieu's one

Key management, and specifically storing keys securely, is one of the harder tasks in the security field. By the principle "security is as strong as the weakest link", handing out private keys to multiple parties is a bad idea - an attacker wins as soon as he corrupts the most insecure device.

The advantage is, that you only have to encrypt something once in a multicast setting. However, this can also be achieved by hybrid encryption (as fgrieu already noted) very easily: Use a symmetric scheme with a randomly generated key to encrypt your data. You upload or broadcast this just once. And for each user you send this symmetric key encrypted with their own public key.

Especially with larger amounts of data, hybrid encryption is very efficient, because symmetric encryption is a lot faster than public key encryption (and depending on the scheme, even more so for decryption). The overhead for each user is quite low, as it only takes a single message with 1-2 KB (4 at most, e.g. for 4096 bit RSA)

Writing this as a serpate answer, but it goes along fgrieu's one

Key management, and specifically storing keys securely, is one of the harder tasks in the security field. By the principle "security is as strong as the weakest link", handing out private keys to multiple parties is a bad idea - an attacker wins as soon as he corrupts the most insecure device.

The advantage is, that you only have to encrypt something once in a multicast setting. However, this can also be achieved by hybrid encryption (as fgrieu already noted) very easily: Use a symmetric scheme with a randomly generated key to encrypt your data. You upload or broadcast this just once. And for each user you send this symmetric key encrypted with their own public key.

Especially with larger amounts of data, hybrid encryption is very efficient, because symmetric encryption is a lot faster than public key encryption (and depending on the scheme, even more so for decryption). The overhead for each user is quite low, as it only takes a single message of a few hundred bytes (e.g. RSA requires 150 byte (1200 bit) to 512 byte (4096 bit), and some additional overhead with user ID, etc.)