Given any number of signatures for the messages you choose, is it possible to construct a valid signature for another key that is somehow related to the first one?
Let $P$ be the initial public key and $G$ be the base point. We would like to construct a valid signature for the key $P + c \cdot G$, where we can also choose $c$.
Is it possible to do this at least for some chosen key, but we should be able to sign any message?
For the original key we can't, it's EUF-CMA I think. But maybe there are corresponding statements for other keys? For example, if we didn't include the public key in the hashing, we could produce something like this.
