How could an offline app verify a signature from one of many private keys?
You seem to be the person that is responsible for the private keys or at least the app. In that case you should look into PKI: public key infrastructure.

The most well known PKI infrastructure is that for TLS certificates. If you take a look at the certificate store of your favorite browser you'll see that there are no certificates there for your favorite services. Instead there is a set of trusted certificates of different certificate issuers. These are used to sign other certificates, in the end one of these certificates is the certificate of the end user, in this case a web server. This end-user is certificate is called a leaf certificate. The first certificate in the chain is called a root certificate. The certificates together look like a certificate tree.

The idea of a PKI is that the public key is part of the certificate. In the end this public key is trusted because there is a chain of certificates leading to a certificate that is trusted.



So you should become your own CA: you will create a self-signed root certificate, which is shipped with (and therefore trusted) by your app. You sign other certificates using the private key that is part of the key pair for the root certificate. Now the users can use their private key to create a signature, and have that signature be accompanied by the certificate that contains the public key of the user. Once that certificate is trusted by chain verification to the root certificate, the public key is trusted and can be used to finally verify the signature.

Generally PKIX is used, which uses a specific type of certificates called X.509 certificates. There is pre-made software that can be used to create certificates. An example is openssl ca.



The difficulty with your approach is not the security - public key or certificate pinning is a valid approach. The problem is the management: each time you add a key you need to update all your software. That is not the case if you can verify a certificate chain, only one certificate needs to be trusted. A certificate can also contain things such as identity, issuer, validity period, key usage and more.

Note that revoking a certificate or public key can be more tricky. You may need e.g. an Online Certificate Revocation Status protocol server so certificates and public keys can be trusted to be still valid.