Mapping the hash of message to a point of elliptic curve for signature Let the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. We want to map the hash of arbitrary message $m$ to a point in $G$ for use in the signature algorithm (such as BLS).
Why we don't use $k=h(m) \bmod q$ and then $S=kP$, whereas it is clear that the point $S$ is in $G$?
What is the flaw of this? security or efficiency?
That's insecure.
In BLS signatures: for private key $x$ and public key $X = xP$, the signature is computed as $T = xS$, and the verification checks if $e(T, P) = e(S, X)$, which works because:

$e(T, P) = e(xS, P) = e(xS, P) = e(S, P)^x$
$e(S,X) = e(S, xP) = e(S, P)^x$

If you know that $S = kP$, then you can forge a signature for a message with hash $k'$ from a signature of a message with hash $k$ by simply computing $T' = k'k^{-1}T$, which works because:

$T' = k'k^{-1}xS = k'k^{-1}xkP = xk'P = xS'$