Key Substitution Attacks on Multisignature Schemes