I understand the original O(n) implementation of a ring signature, but I'm trying to figure out where the state of the art is on signing a message as an anonymous member of an ad hoc group without revealing which member of the group signed it. It seems there are sublinear implementations, but I don't have a good grasp of their tradeoffs, and some have been shown to be insecure years later. For example, I've found: http://diyhpl.us/~bryan/papers2/bitcoin/Practical%20constant-size%20ring%20signature.pdf, which seems to require a trusted third party to accumulate public keys, but a follow up a couple years later seems to have shown it to be forgeable. I'm also aware of papers on "zero knowledge proof of set membership", which sounds similar, but I'm not sure is the same as a ring signature.
I would greatly appreciate an overview of current implementations.