From Bolt-11:
A reader
if a valid `n` field is provided:
MUST use the `n` field to validate the signature instead
of performing signature recovery.
Is this merely a performance optimization? Is there a situation where the declared public key field differs from the public key that would have been recovered from the signature?
Recovery of a public key from an ECDSA signature is not unique. This is because the r value in a signature is only the x-coordinate of a point, so there are actually two points R and -R that have the same x-coordinate, and both will give a different public key. Actually, for completeness, you can even end up with four possible public keys - but this happens with negligible probability.
In bolt-11, a recovery ID which takes values 0, 1, 2, or 3 is used to specify which of these four public keys should be used. But indeed, it is more efficient to simply use the given public key n. I don't think there are other practical benefits other than efficiency and perhaps robustness in case something goes wrong during recovery. n should always be one of the keys recovered, otherwise signature validation will fail.
