lattice-based signature schemes