Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs to Bob, who knows Alice's public key.
Can Bob, without interacting with Alice, generate a new aggregate signature for the entire message set, i.e. ($\mathcal M, s')$, that validates with Alice's public key?
If I understand it correctly, this is achievable using BLS signatures, but I was wondering if there is a simpler and more efficient method available if there is only one signer. I am mainly concerned with validation speed.
Thanks in advance.