What are the benefits of being able to choose (most of) the public key in a PKC?
That property lets a trusted n2-byte random string be
enough to make the rest of public keys fit into n bytes.
In particular, forward secrecy can be more efficient if the sender can store such a string, since the string can have been generated by the same party as generates the rest of the public keys.



Also, if for random private keys and independent n2-byte random strings r0 and r1,

the distributions
$\langle$ rest_of_public_key_(r0,priv_key) , r0 $\rangle$ ​ ​ ​ , ​ ​ ​ $\langle$ rest_of_public_key_(r1,priv_key) , r0 $\rangle$
are indistinguishable

and

"encryptions" with ​ ​ $\langle$ rest_of_public_key_(r1,priv_key) , r0 $\rangle$

provide confidentiality even against the private key holder

, ​ ​ then you get a one-message-in-each-direction

oblivious transfer protocol against semi-honest receivers.