- Each member has no right to sign more than 1 message;
As pointed out in the comments, any mechanism to prevent a group member from generating two signatures would require either trusted hardware or an interaction during the signing process with the group controller Alice (to prevent the signer from resetting his state after generating the first signature and then going ahead with a second signature).
So, what I'll translate this into "it is detectable if a member attempts to signs two messages", that is, given the two signatures, we can verify whether the same group member signed both of them.
With that translation, it is possible; here is one approach:
Alice generates a stateful hash based signature system (e.g. LMS or XMSS), with the various one-time signature keys being independent (that is, you can't reconstruct one from another one)
For each group member Bob, Carol and Dan, Alice selects a random leaf (one time signature), and gives that group member the index, the private key for the one time signature and the authentication path.
When Bob wants to sign his one message, he signs it with his private key, and outputs that signature (along with the index and the authentication path), generating a valid LMS or XMSS signature
The verifier performs the standard LMS/XMSS validity checking against the public key
If the signature verifies, the verifier knows that whoever generated the signature had a valid one-time signature key, and so it must have been a valid group member (or the group controller). And, since the indices were randomly assigned, he has no idea which one it was).
And, if Bob decides to sign two different messages, he has to include the same leaf index in both signatures (that index is the only one she knows how to sign with) - it is obvious that the two signatures have the same index. This remains true even if we had Bob and Carol (and possibly others) mutually cooperating - they can only generate signatures that has an index that one of those group members have.
This approach does have the cavaet that if Bob does sign two different messages, then someone else could possibly sign a third message (based on Bob's two signatures); the forged signature would look like it also came from Bob.
As written, this approach relies on the fact that a group member is allowed to sign only one message - it can be extended if a group member is allowed to sign N messages (by assigning each group member N consecutive leaf indicies and private keys).
