I know this seems a bit contrived, but I’m a layperson to cryptographic systems and have been trying to think if it’s possible to devise a scheme where it’s possible for a sender to prove, in a public key cryptosystem, that a given ciphertext was encrypted with a given public key, without significantly weakening the security properties of the ciphertext. It seems like there’s no obvious way to do this using typical primitives you’d find in a public key cryptosystem. I have been wondering if it is perhaps possible to devise such a scheme with the help of homomorphic encryption, but I simply can’t wrap my head around how you might go about this.
Is this an impossible, or perhaps at least impractical, problem? Is there perhaps another way to think about this that would be practical?