[cryptography/bls12381] Review `aggregate` Module API

[patrick-ogrady]

Related: #2624

aggregate is error-prone/tricky to use but "does the job". We should evaluate whether the functionality can be salvaged into some safer interface or make it private (and push everyone to certificate).

I think its worth keeping public because if we found it useful (to implement something like certificate), I believe others will too (or they'll need to re-implement themselves...which seems even more error-prone).

[patrick-ogrady]

From @cronokirby:

I think we should just eliminate this module completely. certificate provides the same functionality in a much better and more robust way, and the level of abstraction here is needlessly low.

In any case, I think the current API provides too many moving parts, which reflect the operations that happen, but not the semantics you want.

Conceptually, what we're trying to do is to compress a list of signatures into a single artifact. We could just as well do this by simply defining this to be an actual list.

I think a better API would be:

AggregateSignature::new(&[(PublicKey, Signature]) -> Self;

AggregateSignature::verify(&self, &[PublicKey]) -> bool;

the surface is much simpler, and provides what you need for certificates, rather than allowing odd operations.

(You also don't need combine_messages at all, for which the batch API is more appropriate).

[patrick-ogrady]

As part of this change, we should consider wrapping PublicKey in some type that indicates a PoP has already been performed.

[patrick-ogrady]

When considering whether to axe verify_same_signer, consider #1353