Encryption scheme with equivalent keys?
I don't know of any scheme that provides this, and it sounds tricky to build one.

Here's the closest I can come up with.  Let $n=pq$ be a 2048-bit RSA modulus, $d$ be a random 2048-bit number that is relatively prime to $(p-1)(q-1)$, and $e = d^{-1} \bmod (p-1)(q-1)$.  The master secret is $d$; $n$ will be baked into the description of the encryption algorithm $E$.  Let $\text{truncate}(z)$ be the result of truncating $z$ to 128 bits: say, deleting the low 1920 bits and keeping the high 128 bits.  Then, define $$E_k(x) = AES(\text{truncate}(k^e \bmod n), x),$$
and similarly for $D_k(x)$.  In other words, the key $k$ is a 2048-bit string.  To encrypt under $k$, we raise the key $k$ to the power $e$ modulo $n$ (a textbook-RSA encryption of $k$), keep the first 128 bits, and use that as an AES key to encrypt the message $x$.

Given a key $k$ and knowledge of the master secret, it is easy to derive many other keys that will be equivalent (just tweak the low bits of $k^e \bmod n$ randomly, then raise that to the $d$th power modulo $n$, and you've got an equivalent key).

This satisfies your requirements 1-4, but not requirement 5.  Why do you need your requirement 5?  I wonder if we might be able to weaken the requirement somehow and still get something that is sufficient for your application.