With ECDSA (and possibly DSA too) I'm aware that if the same value for $k$ is used with the same private key $D_A$ to sign two different messages, then anyone possessing the two messages $m_0$ and $m_1$ and two signatures $(r_0, s_0)$ and $(r_1, s_1)$may recover $D_A$ trivially (as in fail0verflow's PS3 private key recovery).
Does there exist a way of using this weakness to make a signature system where each private key can only be used once, with the deterrent that if the private key is used a second time, everyone can calculate and use it?
This would require an extra verification step to prove that $k$ was deterministically generated from $D_A$ (in a prescribed manner) so that signings would only be valid, if they used the single, known way of calculating $k$ (without revealing $k$). Otherwise, if a malicious signer were to use different $k$s for the same $D_A$ there would be nothing to deter it, so $k$ must be a deterministically generated from $D_A$.
(This is different from RFC 6979 which uses a hash of the message and $D_A$ to ensure a good pseudo-random value for $k$.)
From answers to With ECDSA is there a way for the verifier to calculate any properties of $k$? and With EC secp256k1 is there a way of transforming a function of the private key to a function of the public key? it looks like this is impossible.
Is there a way of making a single-use signature scheme, where a second use of a private key discloses that private key to the world?
