Asymmetric code signing also tied to a device

I have an asymmetric key pair. The public key is stored in many targets. Is there a way to take that private key K, derive a new private key K' with a known value x, sign the code, and then each target can take the same value x and derive a public key that pairs with K' and verify the code?

I want to authenticate code for only a specific device, but only have the ability to store a common public key in many targets. So the known value x would be some kind of hardware serial number.

• Do you have hardware serial numbers or something along those lines available?
– SEJPM
Aug 7 '17 at 18:32
• Do you just want to make sure device y rejects an update for device x? If so, can you just put the device id in the signature, and have each device check (a) whether the signature is valid, and (b) whether the signed device id matches its own device id? Aug 7 '17 at 20:16
• Does your ​ "K' with a" ​ mean "K' using a" or ​ "K' and a" ? ​ ​ ​ ​
– user991
Aug 7 '17 at 21:18

$\newcommand{\Z}{\mathbb{Z}}$The basic idea of an elliptic-curve signature scheme using an order-$\ell$ group of $k$-rational points of an elliptic curve $E$ is that a private key is a secret scalar $a \in \Z/\ell\Z$, a public key is the curve point $A = [a]P$ where $P$ is a standard $k$-rational order-$\ell$ base point, and a signature is some point and scalar that satisfies some verification equation involving $A$.
The basic idea of an elliptic-curve hierarchical/blinded signature scheme is to ‘tweak’ the public key and private key in the same way by another scalar $t \in \Z/\ell\Z$. The derived private key is the scalar $a_t \equiv t a \pmod \ell$, and the derived public key is the curve point $A_t = [t]A = [t a]P = [a_t]P$. The signature verification equation is the same as in the underlying signature scheme. Anyone who knows the tweak and the original public key can verify signatures using the derived public key; anyone who doesn't know the tweak can't tell a derived public key from any other curve point.