My understanding is that the public key can start with 04 if it's uncompressed, or 02(x-coor) or 03(y-coor) if it's compressed.
That's not exactly right. There are two encodings:
- Uncompressed encoding: (0x04, X coordinate, Y coordinate)
- Compressed encoding:
- (0x02, X coordinate) if Y is even
- (0x03, X coordinate) if Y is odd
What's the purpose of this?
And if this is indeed the case, why would you want a compressed public key?
If you're asking about intent, you need to be aware that these standards for encoding aren't specific to Bitcoin. They're defined by SEC1, and adopted by many other systems. Presumably their goal for having both is:
- Compressed encoding is smaller, and thus desirable when space/bandwidth considerations matter more.
- Uncompressed encoding is slightly more efficient to work with, so if space/bandwidth isn't a concern it's faster to choose this.
If Bitcoin was designed today, it would probably only have compressed keys.
Greater entropy as we can have a larger public key if it's uncompressed?
Wouldn't it be safer to use the larger one?
No, there is a one-to-one conversion between compressed and uncompressed keys, in both direction. There is no difference in entropy (both have 256 bits of entropy) and thus equally secure.