I was reading up on blind signatures. I came across the following paragraph in this paper.
Previous methods of proofs used to establish security arguments for signature schemes no longer work since, during the collusion between the signer, the attacker and the random oracle, we lose control over the value that the signer receives: it no longer comes from the random oracle, but from the attacker. As a consequence, the signer cannot be simulated without the secret key, otherwise the signature scheme would be universally forgeable
The authors go on to use the concept of witness indistinguishibilty to solve the above problem.
I am not able to understand what the author means by :
the signer cannot be simulated without the secret key.
Can anyone explain why this is the case?