Compressing BLS signature with a hash function
but I'm wondering if there are any other issues with using this scheme:
  
  $H_2(e(P, H(m))) \stackrel{?}{=} s$


The obvious problem is that anyone with the public key can compute everything on the left side, and hence forge a signature to any message they want.