Scheme to derive an encryption key from one's verification key, so they can reduce the decryption key from it and their signing key?

Question

There is DH key exchange, but it requires an exchange before participants get to the shared secret. If Bob has only published a verifying key V_B, is there a scheme where the following can be achieved?

1. Alice, from Bob's verification key V_B and some nonce N, derives an ephemeral encryption key E_B for Bob
2. Bob, from E_B, N and S_B, reduces the decryption key D_B
3. Without knowledge of S_B, Alice can not reduce D_B from what they have