bls_sig_verify non-optimal because aggregates G2 sigs inside circuit

[samlaf]

bls_sig_verify currently takes a list of G1 pubkeys and a list (!) of G2 signatures, which it sums inside the circuit.

Discussed with @jonathanpwang that this is unoptimal and in most cases not needed. Would be nice to have another implementation that takes an already aggregated G2 sig. :)