Key Substitution Attacks on Some Provably Secure Signature Schemes