The problem of finding private key from public key is typically studied in the one-key setup: what's the expected cost of breaking one key (e.g. by factoring a public modulus, or solving a discrete logarithm in some group).
There is much less work on simultaneously attacking $k>1$ keys. One notable exception is Daniel J. Bernstein and Tanja Lange's Batch NFS, in proceedings of SAC 2014. They conclude that increasing $k$ allows asymptotic savings on the expected cost per factorization.
A different problem is attacking any one in $k>1$ keys. It seems understudied too, although it is of practical concern, especially in setups where there can't be a revocation list. For example, there are deployed systems such that an attacker could gather many thousands public keys of devices that can write in Smart Cards after authentication, and does not care which one is broken: whatever one allows falsifying records made in the Smart Cards. Also, from a public relations perspective, it's hard to convey that indeed, a hacker demonstrated breaking one key in your system, but it is still safe enough since there's no positive evidence that the adversary could attack a particular key.
We can trivially state that the expected difficulty of attacking any one in $k$ public keys is at most that of attacking one key. I conjecture that it is at least $1/k$ that, at least in the case of factorization.
Can we be more precise, in general, or in the special cases of factorization (RSA…), discrete logarithm in $\Bbb Z_p^*$ (DSA…) or elliptic curve group groups (ECDSA, EdDSA…)?
Update: Poncho quickly pointed that the problem is settled for the discrete logarithm with shared parameters like public prime modulus or curve, which is customary. The question remains in general, for factorization, and DL with per-key parameters.