I've been reading a lot about transaction malleability, and noticed that the only way to achieve it is by altering the transaction signature/s.
Why does the protocol even consider the signature in the payload for SHA256? The protocol should only consider inputs and outputs as they are, ignore the signatures. txID should only be altered by altering inputs or outputs, thats it. If anybody would like to alter any input or output to change the txID, he'll need to change signatures as well.
In other words, if you don't consider signatures while generating the txID, transaction malleability would be impossible.
Please, let me know if I'm missing something here.