We currently have the need to authenticate and verify generated keypairs. Our system allows users to register for our service which generates them a key-pair for use on our network. We are in need of a way to authenticate key-pairs so that we can verify they were generated by us, and not by someone else.
Is it possible to sign each of the generated key-pairs with a master key that can then be used to verify each generated key-pair? I thought this must be possible because it is somewhat similar to the way in which certificates work.
EDIT: To be more clear on what I am after. We are developing a decentralized content network (as a proof of concept). Authoritive Content Providers (those who are authoritive over the content they serve) will be allowed to register their "domain name" via a master registry. This master registry will maintain a master keypair that is used. The registry will issue the content provider a keypair that can be used to digitally sign their content and any information transmitted so that the client can verify that the person transmitting the data is authoritive over the domain name. The issue we are having is how to communicate to the client when we issue a new key pair to a new authoritive host? We thought that if we could sign each keypair with the master registries keypair, then we could hardcode the public key into the client and use it to verify each keypair.