Can Bob, without interacting with Alice, generate a new aggregate signature for the entire message set, i.e. (M,s′), that validates with Alice's public key?

That would be troubling if Bob could sign anything validable by Alice's key (on behalve Alice).

if there is a simpler and more efficient method available if there is only one signer. I am mainly concerned with validation speed.

I am not sure if it's the most efficient way, however I may disclose how it was done in reality. At one of the public sector publishers the publisher is mandatory to digitally sign a set of publications and all their translations. So the system generates a new message consisting of a list of publications and their hashes and then the whole list is signed. However - in this case the concern here was signing speed (so the signing person doesn't need to enter her PIN into HSM for every single publication).

Can Bob, without interacting with Alice, generate a new aggregate signature for the entire message set, i.e. (M,s′), that validates with Alice's public key?

That would be troubling if Bob could sign anything verifiable by Alice's key (on behalf Alice).

if there is a simpler and more efficient method available if there is only one signer. I am mainly concerned with validation speed.

I am not sure if it's the most efficient way, however, I may disclose how it was done in reality. At one of the public sector publishers, the publisher is mandatory to digitally sign a set of publications and all their translations. So the system generates a new message consisting of a list of publications and their hashes and then the whole list is signed. However - in this case, the concern here was signing speed (so the signing person doesn't need to enter her PIN into HSM for every single publication).

Can Bob, without interacting with Alice, generate a new aggregate signature for the entire message set, i.e. (M,s′), that validates with Alice's public key?

That would be troubling if Bob could sign anything validable by Alice's key (on behalve Alice).

if there is a simpler and more efficient method available if there is only one signer. I am mainly concerned with validation speed.

I am not sure if it's the most efficient way, however I may disclose how it was done in reality. At one of the public sector publishers the publisher is mandatory to digitally sign a set of publications and all their translations. So the system generates a new message consisting of a list of pubications and their hashes and then the whole list is signed. However - in this case the concern here was signing speed (so the signing person doesn't need to enter her PIN into HSM for every single publication).

Can Bob, without interacting with Alice, generate a new aggregate signature for the entire message set, i.e. (M,s′), that validates with Alice's public key?

That would be troubling if Bob could sign anything validable by Alice's key (on behalve Alice).

if there is a simpler and more efficient method available if there is only one signer. I am mainly concerned with validation speed.

I am not sure if it's the most efficient way, however I may disclose how it was done in reality. At one of the public sector publishers the publisher is mandatory to digitally sign a set of publications and all their translations. So the system generates a new message consisting of a list of publications and their hashes and then the whole list is signed. However - in this case the concern here was signing speed (so the signing person doesn't need to enter her PIN into HSM for every single publication).