Public key aggregation combines the public keys of selected signers into one group element. The selected nodes arrive as indices into an ordered public-key list; signatures can appear in any order because group addition is commutative. Public-key aggregation uses the field-extension curve, while signature aggregation uses the base curve. section 18.5
An implementation follows this flow:
- Pass the resulting aggregate key to subgroup-signature verification, alongside the message, signer list, and aggregate signature. section 18.5
