Key-homomorphic signatures: definitions and applications to multiparty signatures and non-interactive zero-knowledge