This method is very interesting as the size of the signature and the number of computations remains constant and the resulting scheme is completely generic. Moreover, the size of verification work is constant. During the revocation protocol, computations are very simple and relatively independent from the number of revoked members, as the revocation manager only has to modify the resulting chain and has to compute the new linked signature. The only drawback is the probability of mistake, but since it can be made negligible, this third solution seems to be the more attractive one.