I have a server S to which a client system can establish connections using predefined roles R1, R2, ...Rn.
For mutal exchange of data and for authentication with GCM/GMAC a set of symmetric AES-128 keys are used for each Role.
The symmetric keys are agreed between the parties by use of elliptic curve Diffie Helmann key agrement (ECDH).
For that purpose, the intermediate DH "public keys" (Q=d*G, G=Base point, d=random big integer), needed to create the shared secret are signed with a signing key Ks and sent to the other side. This is to guarantee authenticy.
The ECC key pairs for the signing keys Ks (public and private on each side) are preestablished and can be regenerated on demand (out of scope here).
Should each client role have an individual private signing key Ks(Role) whose public key must be known by S (certificate for signature verification) or is just one Ks for all roles adequate? I think, because the roles are different entities (users), they should naturally also be separated in terms of their signing keys.
But: should the server keep a private signing key Ks(Role) assigned to each role, or would it be OK just to have one common private key Ks for the server as a whole? I tend to plan only one common server side key, but cannot really argue why or why not.