I think it's something like the user holds private key A, publicizes public key A, and requests private key B such that public key A+B has the desired characteristics and private key A+B is only known if you have private key A.