Key-insulated aggregate signature