Group Signatures with Verifier-Local Revocation and Backward Unlinkability in the Standard Model