ECDSA signatures depend on parameter k that is chosen by the signer. As a result, there are many signatures for the same private key d and message m.
What I want to achieve is a deterministic signature. That is, given private key d and message m, there should be only one valid signature. I could go with RSA (with deterministic PKCS#1 v1.5 padding) but would prefer ECDSA if possible as it is almost as widely deployed and has smaller key and signature sizes.
RFC 6979 describes how k can be generated deterministically but it doesn't solve my problem because those who verify the signature can't verify that the signer did actually follow RFC 6979 (I'm not aware of any such method).
I'm thinking about imposing some additional requirements on signers that others can easily verify.
For example, what if I require that all signers derive k using a formula like this:
k = H(m) * d
where d is private key, and H is hash function. Then in signature (r, s), r is x-coordinate of
k x G = H(m) * d x G = H(m) * Q
where G is generator, Q = d x G is public key, and x denotes EC multiplication.
Unless I'm getting EC math wrong, this choice of k derivation function has the advantage that it can be easily verified by multiplying public key point by H(m) and comparing the x-coordinate of this point with r from the signature. At the same time, it seems, all the security requirements for k are still satisfied: it is private since it is derived from private key and it is different for each message as it depends on message hash.
Will it work? Any other ways to create deterministic signatures?