Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)? Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $x$.  I am curious to know if this signature scheme can be used to perform public key validation in the following sense:

Alice provides Bob with a signature $(e,s)$ for some message $m$ and a public key $Y$.
Bob verifies that the signature $(e,s)$ like so:

Calculate $R = (s \cdot G) -  (e \cdot Y)$
Set $e_v = H(R_x || m)$
Accept signature iff $e_v = e$



Can this scheme be used to ensure the public key provided by Alice is indeed of the form $Y = n \cdot G$ (and not say of another form $Y = n \cdot G + n' \cdot G'$?). Assume Alice is computationally bounded and in particular cannot solve the discrete logarithm problem. Or is there a way for Alice to carefully choose the values $(e,s)$ such that Bob accepts the signature even if $Y$ is of them form $Y = x \cdot G + x' \cdot G'$?
As long as the public key is in the elliptic curve group, there is no such thing as being &quot;of the correct form&quot; or not. For any point $P$ in the group, there exists a value $x$ such that $P=x\cdot G$. Thus, all that is necessary is to check that $P$ is indeed in the group. This is carried out by checking (1) that $P=(x,y)$ is on the elliptic curve itself (i.e., it fulfills the equation), (2) that $P$ is not the identity (i.e., the point at infinity, or zero), and (3) that $q \cdot P = 1$, where $q$ is the order of the Elliptic curve group that you are working in. (The third check is needed when the number of points on the Elliptic curve is greater than the size of the subgroup you are working in.)
A completely separate question is whether or not the public-key owner can prove that he knows the associated private-key. That is, do they actually know $x$ such that $P=x\cdot G$. This can be done using a zero-knowledge proof, but actually a Schnorr signature is exactly a zero-knowledge proof of this fact. Indeed, providing an ECDSA signature would also work. However, you need to make sure that this can't be used to extract a meaningful signature that they never meant to sign...