A method for aggregating digital signatures, the method comprising: - an aggregator receiving a set of first data packages from a set of signers (S1, S2), a respective first data package comprising a respective signer identifier, a respective payload, and a respective payload signature obtained by using a respective first secret key of a respective signer (S1, S2); - the aggregator verifying the payload signatures to determine whether or not the payloads are correctly signed; - the aggregator bundling a set of correctly signed payloads into a batch; - the aggregator obtaining a batch digest for the batch, and proofs of inclusion of the payloads in the batch; - the aggregator sending a respective second data package comprising the batch digest and a respective proof of inclusion to the respective signer (S1, S2), the respective proof of inclusion proving that the payload of the respective signer (S1, S2) is included in the batch; - the aggregator receiving a set of third data packages from the set of signers (S1, S2), a respective third data package comprising the respective signer identifier, and a respective batch digest signature obtained by using a respective second secret key of the respective signer (S1, S2), the respective second secret key being from a signature scheme supporting aggregatable signatures; - the aggregator verifying the received batch digest signatures to determine whether or not the batch digest is correctly signed by the set of signers (S1, S2); - the aggregator aggregating a set of correctly signed batch digest signatures to obtain an aggregated batch digest signature; and - the aggregator including the aggregated batch digest signature in the batch. - an aggregator receiving a set of first data packages from a set of signers (S1, S2), a respective first data package comprising a respective signer identifier, a respective payload, and a respective payload signature obtained by using a respective first secret key of a respective signer (S1, S2); - the aggregator verifying the payload signatures to determine whether or not the payloads are correctly signed; - the aggregator bundling a set of correctly signed payloads into a batch; - the aggregator obtaining a batch digest for the batch, and proofs of inclusion of the payloads in the batch; - the aggregator sending a respective second data package comprising the batch digest and a respective proof of inclusion to the respective signer (S1, S2), the respective proof of inclusion proving that the payload of the respective signer (S1, S2) is included in the batch; - the aggregator receiving a set of third data packages from the set of signers (S1, S2), a respective third data package comprising the respective signer identifier, and a respective batch digest signature obtained by using a respective second secret key of the respective signer (S1, S2), the respective second secret key being from a signature scheme supporting aggregatable signatures; - the aggregator verifying the received batch digest signatures to determine whether or not the batch digest is correctly signed by the set of signers (S1, S2); - the aggregator aggregating a set of correctly signed batch digest signatures to obtain an aggregated batch digest signature; and - the aggregator including the aggregated batch digest signature in the batch.