Limiting how many key pairs someone can generate without compromising their keys Is there any way to assign someone a limited quota for how many cryptographic key pairs they can generate (ECC, RSA, any algorithm), and preferably non-interactively? By non-interactively I mean there is no multiple handshake or multiple round trips between me and the person doing the generating and the relationship could perhaps be anonymous.

I'm imagining something where I generate, say, 50 tokens/certificates/whatevers and give them to someone. That person is then able to generate 50 key pairs and I am able to test to ensure that those 50 key pairs were properly entitled.

Of course the person could generate more key pairs without using my entitlements, but those would not check out.

I have a sense that something like this could be possible with homomorphic encryption or zero knowledge proofs or something similar but I can't think of a way to do it.
Anybody can run any of the usual generators for asymmetric primitives as many times as they want. And they can do this without compromising the security of the private key. Generally the trust of a key pair by a user is however not in the private key, but in the public key or certificate around the public key.

Now you could embed a signed token in the certificate, but in that case you must make sure that the token cannot be reused. This could for instance be managed by a trusted third party, such as a Certificate Authority. You could for instance create a certificate extension and require a CA to validate that the token isn't reused. You then have another party to hold responsible if a duplicate token is ever found.

What you cannot do in this digital world is avoiding duplication. This can only be managed if you somehow manage to secure the processing of the data. For more information on that you'd have to look at digital rights management (DRM) rather than homomorphic encryption or zero-knowledge proofs - if you ask me.

And while I generally try and refrain from using buzz, this might be  a case where blockchain technology could actually be helpful in case you don't want to use a CA / centralized management.