Multisignatures secure under the discrete logarithm assumption and a generalized forking lemma