In our file sharing scenario there are three participants: $A$, $B$ and $C$. Each participant has a public-private key pair (let's assume RSA for now). $A$ wants to share a symmetric AES key $k$ with the other participants. $B$ is given access to the file for free, while $C$ has to pay a fee for it. Thus, $A$ may potentially cheat $C$ by providing a wrong key $k'$, and $B$ should be able to act as an arbitrator in case of dispute.
The sequence is as follows:
$A$ first shares the AES key $k$ with $B$ by encrypting it with $B$'s public key and makes it available to $B$. Now $A$ and $B$ have access to the symmetric AES key.
Then, $A$ shares the same key $k$ with $C$ by encrypting it with $C$'s public key, making the ciphertext available to all participants.
$B$ should now be able to prove that the ciphertext provided to $C$ is indeed the key $k$ encrypted with $C$'s public key.
This would be possible by using textbook RSA, where the ciphertext is deterministic. Since textbook RSA is insecure, this is not an option. I take it that this is similar to key escrow schemes/verifiable encryption, but I've been unable to figure out a scheme/crypto implementation for the proposed scenario.