Lattice-based linearly homomorphic signatures