I have a situation where an offline app needs to be able to verify whether some data was created by a set of privileged users of the app. These privileged users will each have one private key of some sort that can be used to sign this data. Any user (privileged or not) must be able to verify that the data came from a privileged user.
I'm not sure what the number of privileged users is going to be, but for the sake of discussion we can assume it will be no more than 100,000. And the app being offline means it can't rely on connecting to a server to verify any data or update itself.
I know one possible way to do this with public-key cryptography would be to generate all of the needed public/private key pairs ahead of time, include all of the public keys in the app itself, and give each privileged user one private key. Then signed data from privileged users could include some metadata that identifies which public key should be used to verify its signature.
However, I'm not sure what the security implications of that method is. I'd also like to keep my app as compact as possible. If I used 2048-bit RSA encryption then the size of 100,000 public keys would be just under 25 MB. In this day that's not too bad but it'd be nice if that space requirement wasn't there.
So my two questions are:
Are there any significant problems with the above approach?
Is there a cryptography method available that would allow me to do the above without needing to include so many public keys? Ideally it would also a) allow a practically unlimited number of private keys to be generated after the app is released, and b) not have the signatures be anonymous, though neither of those are strictly necessary.
I'm also open to alternative approaches for accomplishing what I'm after. My understanding of cryptography is admittedly not so deep so I may be missing or misunderstanding something.