How do I create a cryptographic signature and commitment scheme with accountable evidence?
I, personally, did not know of any scheme with such properties yet so I took the challenge of creating one and succeeded. After that, I was really unsure on whether to post it or not since it SHOULD NOT BE USED. I decided to do so for the mere point of showing that such schemes are probably possible.


Given an elliptic curve with a generator $G$ of order $q$ and a hash function $H_q(x)$ which maps $x$ to $[1, q]$:

$\operatorname{GenKey}():$


$s_k \leftarrow Z_q$
$P_k := s_kG$
$D_k := H_q(1||s_k)G$


$\operatorname{Sign}(s_k, B):$


$m = H_q(2||s_k||B)$, $M = mG$
$c = H_q(P_k||M||B)$
$p = m+c*s_k$
$\sigma = (M, p)$


$\operatorname{Verify}(P_k, B, \sigma):$


$c = H_q(P_k || M || B)$
Check if $M+cP_k = pG$


So far, this is a variation of the Schnorr signature scheme which uses the hash-function to generate the private masking key, like it's done in EdDSA instead of randomly picking one. Please note that I highly discourage anyone from using this scheme already since it hasn't gone through formal research. 

Based one the rationale that this masking key private, we can use it to create a derivation key to $D_k$.

$\operatorname{GenX}(s_k, B):$


$x = H_q(1||s_k)-H_q(2||s_k||B)$


$\operatorname{DeriveD_k}(\sigma, x):$


$D_k = M + xG$


Let's discuss the properties of this scheme:


Obviously, there is an $X_i$ for each $B_i$ which can be computed easily if you know $s_k$.
Also, each $(\sigma, x)$ tuple should lead to the same $D_k$.
Computing any $\sigma$ should require $s_k$. Calculating $x$ from any $\sigma$ requires knowledge of $s_k$ as well.
Even if you know $D_k$ and a $\sigma$, finding $x$ is as hard as solving the discrete logarithm of $D_k-M$.
Even if you know $D_k$, and choose a $x \leftarrow Z_q$, you would need to forge a signature.
Let's discuss the privacy of the signer by assuming one would compute the challenge by $H_q(M || B)$ and someone knows $\sigma$. He could then compute $P = c^{-1}(pG - M)$. This is circumvented by incorporating the public key into the challenge.
Given a dishonest signer, he could chose a random $y \leftarrow Z_q$ and use it as private key for $D_k$ instead of $H_q(1||s_k)$ or could create commitments which do not lead to $D_k$.


Again, I do not recommend using this scheme since it has not undergone any research at all instead of my two hours.