Requiring a "supervisor" key pair and a "user" key pair to decrypt multiple-recipient messages I've been toying with some encryption scenarios recently. One of the hard ones I came across is a multi-party system. 

So we have


Bob -- The person who sends the message (and knows it's recipients)
Jim -- The person who supervises who is capable of decrypting the message(but can not decrypt the message himself)
Alice -- The person who wants to receive the message
Mark -- The person who also wanted to receive the message, but after Bob sent the message his private key was compromised


For example sake, Bob must post his encrypted message on a public message board. Ideally, Alice and Mark would see the message and know it's intended for them, but they can't decrypt it by themselves. They must ask Jim to apply his decryption skills on the public data first. Jim trusts who is asking for the message because he knows their public keys(and asks for a dynamic signed piece of data or some such). Of course though, Jim won't apply his magic for Mark because he was notified that Mark had been compromised. So, Mark is left in the dark with an undecipherable message

Also, Jim is minimally trustable. So, if Jim wanted to hand the message to some untrusted party, it'd still be fairly useless, unless they themselves learned of one of it's intended recipient's private key as well.

I'm trying to work out the best way to actually do this. Here is one idea:


Bob encrypts his message with a symmetric algorithm. 
Bob encrypts the symmetric key against Alice's and Mark's public key using his private key (two separate "key messages" are thus made)
Finally Bob encrypts both of the key-messages against Jim's public key using his private key


I think this would work. However, I have some concerns


I'm double-encrypting things, which sounds like trouble
I'd have to be encrypting basically the same piece of data against two different keys. Does this leave me vulnerable to cryptoanalysis? What about padding?


Ideally, the first algorithms that came to mind for symmetric encryption is AES. For asymmetric encryption, I was thinking RSA. Is there a better choice? 

Is there any better way of managing such a scenario where you have a "supervisor" which mitigates the risks of a private-key compromise for messages sent to multiple recipients?
Have you considered using Shamir's Secret Sharing algorithm?  

First, Bob encrypts the message with a symmetric algorithm.  Then, he divides the secret key into four parts using SSA such that it requires three parts to decrypt (a $(3,4)$ threshold).  Bob then distributes one part each to Alice and Mark, and two parts to Jim.  

When Alice wants to decrypt, she needs has to have both of Jim's parts plus her part.  If Mark wants to decrypt, he similarly needs both of Jim's parts plus his part.  

Alice and Mark cannot collude to cut Jim out of the middle, because they have only two parts between them, and decryption requires three.  And because Jim has only two parts himself, he cannot decrypt the message unless Alice or Mark shares their part it with him.

Finally, Jim can withhold his parts from anyone he no longer trusts.