Is there an anonymous non-interactive authorisation scheme with peer-side auth. signature generation? I implemented a pseudonymous PKI scheme (by K. Zeng @Springer Link), where all peers can change their public keys including its signature on their own. I am looking for a way to extend it with some authorisation functionality in that way, that an Authorisation Instance can provide specific credentials to a peer. (e.g. give their message credibility, or allow some special message types). Since such a credential could be linked with the identity of the peer, it also should be renewable without the reinvolvment of the Authorisation Instance. Some of the peers only us local communication and, therefore, are not able to contact the Authorisation Instance or the CA.

The papers I read so far, only offered interactive solutions in the form of a challenge response or required the involvement of the Authorisation Instance again. Maybe I searched for the wrong keywords.
I could solve my question using the fundamental work of Eric Verheul: Self-Blindable Credential Certificates from the Weil Pairing.

What I didn't know was the basic principle of self-blinding. In its simplest form, a peer (sk: $x\in Z$, pk: $X=g_1^x\in G_1$) communicates with an authority (sk: $a\in Z$, pk: $A=g_2^a\in G_2$) to get a certificate for his pk. cert: $C=X^a \in G_1$.
Now the peer is able to self blind his public key and the certificate using a random $k \in_R Z$:  $X_b=X^f\in G_1$; $C_b=C^k \in G_1$. This can be verified using $e(X_b,g_2)=e(C_b,A)$ which is $e(g_1^{axf},g_2)=e(g_1^{xf},g_2^a)$.

To add authorisation, a hash of the authorisation information $c=hash(Authorisation Information)$ can be included: $C=X^{a+c}$. Now the verifier needs to recalculate $c=hash(..)$ to verify the authorisation: $e(X_b,g_2)=e(C_b,A \cdot g_2^c)$.

(Just for the record: this example is not secure, since the peer could remove its key from the certificate and then sign any other PK too.)