A method for aggregating digital signatures, the method comprising: - an aggregator (A1) receiving a set of first data packages from a set of signers (S1, S2), a respective first data package comprising a respective signer identifier, a respective payload, and a respective payload signature obtained by using a respective first secret key of a respective signer (S1, S2); - the aggregator (A1) verifying the payload signatures to determine whether or not the payloads are correctly signed; - the aggregator (A1) bundling a set of correctly signed payloads into a batch; - the aggregator (A1) obtaining a batch digest for the batch, and proofs of inclusion of the payloads in the batch; - the aggregator (A1) sending a respective second data package comprising the batch digest and a respective proof of inclusion to the respective signer (S1, S2), the respective proof of inclusion proving that the payload of the respective signer (S1, S2) is included in the batch; - the aggregator (A1) receiving a set of third data packages from the set of signers (S1, S2), a respective third data package comprising the respective signer identifier, and a respective batch digest signature obtained by using a respective second secret key of the respective signer (S1, S2), the respective second secret key being from a signature scheme supporting aggregatable signatures; - the aggregator (A1) verifying the received batch digest signatures to determine whether or not the batch digest is correctly signed by the set of signers (S1, S2); - the aggregator (A1) aggregating a set of correctly signed batch digest signatures to obtain an aggregated batch digest signature; and - the aggregator (A1) including the aggregated batch digest signature in the batch. - an aggregator (A1) receiving a set of first data packages from a set of signers (S1, S2), a respective first data package comprising a respective signer identifier, a respective payload, and a respective payload signature obtained by using a respective first secret key of a respective signer (S1, S2); - the aggregator (A1) verifying the payload signatures to determine whether or not the payloads are correctly signed; - the aggregator (A1) bundling a set of correctly signed payloads into a batch; - the aggregator (A1) obtaining a batch digest for the batch, and proofs of inclusion of the payloads in the batch; - the aggregator (A1) sending a respective second data package comprising the batch digest and a respective proof of inclusion to the respective signer (S1, S2), the respective proof of inclusion proving that the payload of the respective signer (S1, S2) is included in the batch; - the aggregator (A1) receiving a set of third data packages from the set of signers (S1, S2), a respective third data package comprising the respective signer identifier, and a respective batch digest signature obtained by using a respective second secret key of the respective signer (S1, S2), the respective second secret key being from a signature scheme supporting aggregatable signatures; - the aggregator (A1) verifying the received batch digest signatures to determine whether or not the batch digest is correctly signed by the set of signers (S1, S2); - the aggregator (A1) aggregating a set of correctly signed batch digest signatures to obtain an aggregated batch digest signature; and - the aggregator (A1) including the aggregated batch digest signature in the batch. <EOS>