Asymmetric key derivation – Who derives the new pub key can't know the new private key?
I am afraid this answer is long overdue, but what you are asking for is actually possible. It is even easy if you use public key cryptography relying on the discrete logarithm problem to secure the private key, such as ECDSA (for signature) &amp; ECIES (for encryption) for example. And it might probably be possible for other schemes as well, but not as easily (at least, not in a way that seems as straightforward as for the discrete logarithm).

You can go around your problem using something like the derivation of the "shared encryption key" in ECIES. 

In both ECIES and ECDSA, the private key $k$ is a large integer, while the public key $P_{k}$ is a point on the elliptic curve $\mathrm{E}$ derived from $k$ by computing $P_k=k\cdot G$, for $G$ a generator of the curve with large prime order $n$ (which is generally standardized along with the curve you're using).

This means that you can actually derive another public key $k\cdot G$ just like what you are asking for by:


Alice picks a random secret integer $r$
She computes the point $R=r\cdot G$ on the curve $\mathrm{E}$ 
She can then compute the derived public key $P_{kr}$ by adding the public key point $P_k$ and the point $R$ together: $P_{kr}=P_k+R$


And now, the corresponding private key $k'$ is simply $k'=k+r$, because of the definition of the scalar multiplication, which make it distributive over the group law $+$, which means that $P_k+R = k\cdot G + r\cdot G = (k+r)\cdot G$.

So Alice can simply send $r$ to Bob, and Alice would still not be able to sign anything (in the ECDSA case) for this child public key $P_{kr}$. 

Knowledge of $r$ merely allows to discover the "main" public key $P_k$. (So you might want to keep it secret, depending on your needs.)

If you want to adapt the scheme to something else than elliptic curves, you might, but you'll have to rely on the discrete logarithm problem to use the same trick. For instance, this specific method wouldn't work with RSA keys.

PS: I am also aware of a more intricate scheme used in certain Bitcoin wallets, but I haven't had time to study it yet and the scheme presented above is way simpler. But just in case, you might also want to check what's done in BIP32.