In BLS signatures: for private key $x$ and public key $X = xP$, the signature is computed as $T = xS$, and the verification checks if $e(T, P) = e(S, X)$, which works because:
$e(T, P) = e(xS, P) = e(xS, P) = e(S, P)^x$
$e(S,X) = e(S, xP) = e(S, P)^x$
If you know that $S = kP$, then you can forge a signature for a message with hash $k'$ ...
Well, the Boneh-Lynn-Shacham "BLS" signature scheme is currently in the process of being standardized through an Internet Draft named "draft-irtf-cfrg-bls-signature-00" (a working document of the Internet Engineering Task Force "IETF"), which you can track here. It appears Algorand might be behind this process, along with Dan Boneh's own support.
As stated ...
You can. Low-embedding degree may be bad due to the MOV attack, but pairing-friendly curves are particularly chosen so that the embedding degree is low but still enough to not decrease security. So any elliptic curve algorithm should be safe on the curve, not only pairing-based ones.
ECDSA if often used with NIST curves with cofactor 1. ...
You cannot create a verifiable $Z$ but you can create a verifiable $W$ but you have to add public keys multiple times as well. So $W$ can be verified using a key $PK_a + 2*PK_b + 2*PK_c + PK_d$ if you had the same message or doing having multiple pairings for each repeated key in case of distinct messages