I have the following requirement: There are N public/private RSA key pairs. The encrypted data must be decryptable by any of the private keys alone, but not by any other key. For encryption, the server knows and may utilize all the public keys for encryption if the scheme requires so. Does such a scheme exists?