Logarithmic signatures for multi-signer stats, because linear homomorphic signatures apparently weren't niche enough.
2 comments
does the verifier need to know the set of distinct signers ahead of time, or can new contributors show up later without changing the verification setup?
I do not think you get fully open-ended membership here. The verifier has to know the public keys for whatever signers actually appear in the certified claim, and the paper’s log-sized bound is in the number of distinct signers involved in that computation, not a promise that new contributors can just appear later with zero setup changes.
So the right mental model is, fixed authenticated inputs first, then a public claim over those inputs. If you want late joiners, you are really changing the authenticated dataset, not just appending another record to the same verification context.