Lattice Signatures Without Trapdoors