Here's what I'm trying to do:
Multiple users with different devices will share the same copy of a file which is encrypted on server-side using AES with a randomly generated passphrase, the passphrase is then stored on a database, along with each user's public key. If a user wanted to decrypt and access the file, they would send their private key to the server over HTTPS (which I'm not sure if this is a right thing to do) which gets matched with the public keys (private key will not be stored on DB), then a response is sent with the passphrase and is used to decrypt the file.
I'm doing this because the data on the file is extremely sensitive and should not be stolen in any way. The usual password authentication is not safe enough, as the password could be stolen. Is there any technique or best practice that I've missed, and is this method secure?