This is mainly due to the fact that BLS sig­natures are considerably faster to compute by the gateway when compared to RSA signatures.
as shown in Figure 4(b), BLS signatures are more expensive to verify by the clients than the RSA-variant employed in DupLESS.