I would like to provide access to encrypted data through a cloud service provider, using a pay-as-you-go model. This means that we will sometimes need to revoke a user's access to the data. To restrict a revoked user's access, the CSP will re-encrypt the data and send the new key to valid users only through their mail.
Before using the new key they received by mail, however, the users will presumably need some way to verify its integrity and authenticity. If possible, I would like to implement this using only symmetric encryption (like AES) instead of asymmetric encryption like RSA. Is this possible, and if so, how?