Authenticated encryption with Signatures
The ​ ​ nonce || counter ​ ​ version of CTR mode

satisfies the first two of the following conditions.

If

the symmetric encryption scheme is such that different ciphertexts

with the same nonce will decrypt to different plaintexts
and
the symmetric encryption scheme is secure against a single chosen ciphertext

whose nonce was not used for any of the challenge ciphertexts
and
the signature scheme is strongly unforgeable
and
the lengths of encodings of [message,signature] pairs don't reveal

any more about the messages than the lengths of the messages

then sign-then-encrypt will work for a single pair of users, but won't work with

signature verification keys from parties that aren't supposed to know the plaintexts.

I suspect that should generalize to arbitrary stream ciphers.