Why do we need public key as part of Witness in P2WPKH transactions?

Question

As we want to minimize the data payload in a blockchain, which also led to concepts like SegWit, and is matter of discussion in Signature aggregation etc, I wonder why do we actually need to supply public key in order to spend? It's needless 33B of data. ScriptPubKey could look like this <HASH160> OP_CHECKSIG2 and ScriptSig <Signature>. I know this requires Softfork, but as we introduced SegWit, why wasn't this the design? Is it because mapping signature -> public key is not unambiguous?

Edit:
As in the comments suggested: the issue with public key recovery from EC signature is simply trade-off between fast verifiability and space requirements. The public key recovery from signature (r,s) involves conversion of scalar r = x_r into a curve point R = (x_r, y_r), i. e. modular square root. This raises another question:

What's the idea of segwit transaction verification? Do we have multiple levels of consensus rules validation? E.g. basic validation evaluates all transaction scripts according to pre-segwit rules (which is just push of 2 stack items, which is always True), and deep validation that triggers the witness validation logic. I'm not sure whether I should look at segwit as "We moved the data away from transaction that represent just some ownership proof which is relevant at the time of confirmation but not years thereafter" or maybe rather like "Witness data is inherent part of transaction, just as it has always been, and was actually meant as tx-malleability fix and Script language generalization allowing future protocol extension."?

Answer 1

This was discussed today on the #bitcoin-wizards IRC channel. The reasons offered by Andrew Poelstra (andytoshi) were:

1. "Segwit had enough scope already." That is, it was already a large change that some people considered controversial, so minimizing further changes was considered desirable.

2. "Pubkey recovery is incompatible with batch validation." Poelstra goes on to explain that Bitcoin doesn't currently have batch validation for ECDSA and the reasons why, but it doesn't sound to me like batch validation would be impossible to add at a later point (though perhaps it would require a soft fork); presumably devs would prefer to work on batch validation and signature aggregation using Schnorr signatures instead.

Later, Gregory Maxwell (gmaxwell) added that "Certicom has a patent on key recovery that could potentially apply" to a possible construction, which could've made using that construction controversial.

FYI: your second question asked in edits should probably be asked separately as it's a completely different issue.