As we want to minimize the data payload in a blockchain, which also led to concepts like SegWit, and is matter of discussion in Signature aggregation etc, I wonder why do we actually need to supply public key in order to spend? It's needless 33B of data. ScriptPubKey could look like this
<HASH160> OP_CHECKSIG2 and ScriptSig
<Signature>. I know this requires Softfork, but as we introduced SegWit, why wasn't this the design? Is it because mapping signature -> public key is not unambiguous?
As in the comments suggested: the issue with public key recovery from EC signature is simply trade-off between fast verifiability and space requirements. The public key recovery from signature (r,s) involves conversion of scalar r = xr into a curve point R = (xr, yr), i. e. modular square root. This raises another question:
What's the idea of segwit transaction verification? Do we have multiple levels of consensus rules validation? E.g. basic validation evaluates all transaction scripts according to pre-segwit rules (which is just push of 2 stack items, which is always True), and deep validation that triggers the witness validation logic. I'm not sure whether I should look at segwit as "We moved the data away from transaction that represent just some ownership proof which is relevant at the time of confirmation but not years thereafter" or maybe rather like "Witness data is inherent part of transaction, just as it has always been, and was actually meant as tx-malleability fix and Script language generalization allowing future protocol extension."?