Input validation in transactions I'm just writing a small essay about the basics of BTC and I ran into a small problem.

I know, that there are digital signatures in our bitcoins' earlier transactions (our transaction inputs) and in the next owner's public key. How can the system verify, if the input is really from our earlier output? We can just use a random (unspent) output from an earlier block, can't we? I know that we are the next owner and our public key is in the transaction, but we can (and should) generate a a new public-private key for our next transaction, so the new private key won't match our "old" public key... What is that thing I don't know or understand?
Starting from basics, each input spends a previous output:

To spend the output, the input has to include a reference to it (called an outpoint).  This includes the TXID that included the output as well as the sequence number of that output in the transaction (called a vout for output vector).

In order for Alice to pay Bob in a pay-to-public-key-hash (P2PKH) output, Bob needs to create a private key (which he keeps secret), derive a public key, hash that public key (encoding it as a Bitcoin address), and then give that hash to Alice.  Alice uses that hash in a P2PKH output in TX1.

When Bob wants to later spend that output from TX1 (using it as an input), his computer gets the hash (address) from the TX1 output, finds the corresponding public key, inserts that public key into the signature script, then finds the corresponding private key in its secure database, and uses that key to create an ECDSA signature which it also adds to the signature script.

So only one keypair is used per output, although the same keypair may be used in multiple outputs.  (This is called key reuse, and it's discouraged to improve privacy and, possibly, security.)
(The images above are from the Bitcoin.org Developer Guide transactions section, which is under the MIT license.)