I'm looking for a special signature scheme that has the following features:
- There is a group. The group consists of $n$ key centers and 1 user.
- All group members have their own private keys, and public keys that satisfies feature 3.
- If the user signs (or, private key operation) a message using his private key, then the $n$ key centers (or specific $t < n$) can find out what the public key that used to sign the message is (or, who is the user).
Is there any scheme appropriate for these features? Or a scheme which is similar?
I looked at lots of signature schemes such as group/threshold/ring..., but I cannot find a suitable one.