The motivation for key aggregation multisig and threshold schemes (e.g. MuSig(2), FROST etc) in Bitcoin is obvious. Signatures are a large part of every transaction, all the nodes on the network are attempting to verify every signature and signatures in many cases have to be stored as part of the blockchain data structure for the rest of Bitcoin's existence. Hence reducing verification time and reducing the size/number of signatures is critically important.
But Bellare and Neven as early as 2006 and I'm assuming much earlier were working on aggregated multisignatures.
What was the motivation? Were any use cases or organizations attempting to verify multisignatures so frequently that size (bytes)/storage and verification time were relevant concerns pre Bitcoin (2008)? Or is this just a case of academia exploring new research fields many years before they might be used and without a need to justify how these schemes might be used in the "real world"?