Malleable version of Schnorr signature

Question

Given an elliptic curve defined in $\mathbb{F}_{q}$ with a generator $G$ and a hash function $H_{q}(x)$ which maps $x$ to $\mathbb{F}_{q}$. A Schnorr signature variation for a data block $B$ such as:

$SigGen(s, B)$:

1. $m = H_{q}(s||B)$, $M = m \times G$
2. $c = H_{q}(P||M||B)$
3. $p = m + c \cdot s$
4. Outputs $\sigma = (M, p)$

$\text{Verify}(P, B, \sigma)$:

1. $c = H_{q}(P||M||B)$
2. Check if $ p \times G \stackrel{?}{=} M + c \times P$

What would be the implications of changing $c = H_{q}(P||B)$, removing the dependency on $M$?

The only thing I can see is that there exists one $M^{*}$ such that $\sigma = (M, p) = (M^{*}, p)$ is equally valid. But an acceptable compromise in my point of view, if one actually needs to construct a scheme that maintains a deterministic value for $c$ given $B$.

Are there any other drawbacks?

Answer 1

OK, I found my own answer. A catastrophic drawback is $M = p \times G - c \times P$, by changing $c$ to any desired data block.