Kleptographic attacks can be designed for RSA key generation, Diffie–Hellman key exchange, DSA/ECDSA signing, etc. Is it also possible for ECDSA key generation?
More detailed: Is it possible for an attacker to design an ECDSA key generation algorithm, for which the attacker can easily derive the private keys of all generated public keys, while nobody else has any advantage in getting the private keys? (and even nobody else could distinguish public keys generated this way from other public keys)
I'm talking about key generation on a specified curve (such as secp256k1), rather than adding backdoors into ECC parameters. What I am looking for is an ECDSA version of this answer: https://crypto.stackexchange.com/a/32155/58843