How to generate a ciphertext independently decodable with multiple keys? Is it possible to encrypt a message in such a way that multiple keys can independently decrypt it?

In other words:

Having knowledge of $key_1, key_2 ...key_N$, which are different symmetrical keys, is it possible to generate a ciphertext that can be independently decrypted using either $key_1$ or $key_2$ or $key_N$, in such a way that the length of the ciphertext is less than directly proportional to $N$?
One way to do it is to generate a random, single-use key $K$ and encrypt (and preferably authenticate) the message with that. Store the (authenticated) encryption of $K$ under each of $key_1, …, key_N$ alongside the message. The required storage is $\Theta(N + \text{message length})$.

This is routinely done when transmitting messages using asymmetric encryption, for example when sending an email encrypted with PGP to multiple recipient. A the message is encrypted and authenticated with a single-use key, and the encrypted email contains the encryption of that key with each recipient's public key in addition to the ciphertext.