A Group Signature Scheme from Lattice Assumptions