One ciphertext, multiple keys, multiple messages
This functionality is usually called deniable encryption. It is feasible for (innocuous/incriminating) pairs of a few messages.

Wikipedia: 


  Deniable encryption makes it impossible to prove the existence of the plaintext message without the proper encryption key. This may be done by allowing an encrypted message to be decrypted to different sensible plaintexts, depending on the key used. This allows the sender to have plausible deniability if compelled to give up his or her encryption key. The notion of "deniable encryption" was used by Julian Assange and Ralf Weinmann in the Rubberhose filesystem and explored in detail in a paper by Ran Canetti, Cynthia Dwork, Moni Naor, and Rafail Ostrovsky in 1996.


There are related questions and answers, e.g., is-there-an-encryption-decryption-algorithm-that-can-give-two-different-outputs, and deniable-encryption-from-simple-primitives as well as a few others.