Needed: signature over a collection of hashes I'm looking for some kind of crypto-based data structure that will allow me to produce a signature over a set of hashes. Call this a SignedSetOfHashes. I want to be able to distribute the SignedSetOfHashes (which should be smaller than simply a vector of all the hashes and a digital signature.) I then want anyone to be able to verify that hash H is in the SignedSetofHashes having only the SignedSetOfHashes and a public key that matches the private key used to create the signature.

One idea I had was multiplying all of the hashes together in a field and signing the residue. Then I could verify any of the hashes are in by showing that the residue is divisible by any of the hashes. Of course, I could verify the signature without having any of the hashes. 

Is there an existing approach to do this?
I am not quite sure if I exactly get what you are looking for, but I'll give it a try. 

This answer refers to the original question before the edit


  I'm looking for some kind of crypto-based data structure that will allow me to produce a signature over a set of hashes such that I can verify that any of the hashes is in the set at a later point in time without having to distribute all of the hashes.


One possible approach to produce a signature for a sequence of messages $(m_1,\ldots,m_n)$ (or hash values) is to build a Merkle tree from this sequence. 

The idea of a Merkle tree is
to assign the messages $m_i$ to the leaves of a binary tree from left to right,
and do the hashing recursively upwards, starting from the lowest level
in the tree. 

More formally, a Merkle tree
is a complete binary tree, together with a cryptographic hash function
$H:\{0,1\}^*\rightarrow \{0,1\}^{\ell}$ and an assignment
$\phi:N\rightarrow \{0,1\}^{\ell}$, where $N$ is the set of nodes of the
tree. The assignment $\phi$ for the label of the nodes is recursively
defined, where $v_P$ is the parent node
and $v_L$ and $v_R$ the left and right child respectively. Furthermore,
$x$ is a string that is assigned to a leaf.
\begin{equation} \phi(v_P):= \begin{cases}
H(\phi(v_L)||\phi(v_R)) &amp; \text{if $v_P$ has two children};\\
H(\phi(v_L)) &amp; \text{if $v_P$ has one child};\\ H(x) &amp; \text{if $v_P$ is
a leaf.} \end{cases} \end{equation} 
Additionally, define the
authentication path $A_v=\{a_i|0&lt;i\leq
h\}$ of a leaf $v$ as the set containing all values $a_i$. The value
$a_i$ at height $i$ is defined to be the label of the sibling of the
node of height $i$ at the unique path from $v$ to the root.

Note that if your values $(m_1,\ldots,m_n)$ are already hashes, then you can directly assign these values to the leaves (without hashing them again). Subsequently, the $m_i$ are denoted as messages (irrespective if they are messages or hash values).

Put differently, a Merkle tree can be used to release a message $m_i$ and the coresponding authentication path $A_{m_i}$ such that 
everybody is able to verify that $m_i$ "is in the tree", but does not require access to the all the remaining messages. 

Now take a secure signature scheme and sign the root-hash of the Merkle tree. Then given 
the signature, $m_i$ and $A_{m_i}$ it can be checked that $m_i$ is in the signed sequence $(m_1,\ldots,m_n)$ without 
requiring all the other messages $m_j$, $j\neq i$. Basically, from $m_i$ and $A_{m_i}$ one recomputes the root hash and checks the digital signature.

However, note that this does not ensure a real hiding of the remaining messages $m_j$. If the remaining messages have a short length and/or are known to come from a small set, 
one can mount a brute-force attack by simply hashing all possible values and check whether the result 
matches the root hash. 

This can be prevented if one does not use simple hashes for the leaf nodes, but uses 
commitments instead. This approach is for instance applied in redactable signatures (RS) or content extraction signatures (CES).

How does this related to what you seek

You do not have to distribute all hashes, but for every value $m_i$ a "proof" that the value is in the set (the Merkle tree) you have to distribute $(m_i,A_{m_i})$. The advantage is that if you use the commitment based approach as applied in RS or CES, nobody can test against your signature to check if a given value is in the set, unless you want to explicitly allow that by providing $(m_i,A_{m_i})$. 

EDIT (to answer the edited question)

Any approach that will give you cryptographic security guarantees that you will not encounter false positives (such as cryptographic accumulators, Merkle trees, vector commitments, zero-knowledge sets, etc.) will require to provide a "witness" for every value to be able to check against the structure. 

If you tolerate a larger false-positive probability you can use for instance Bloom filters to represent your set and allow set membership queries without any witnesses.