user12987: From Bolt-11:
A reader
if a valid `n` field is provided:
MUST use the `n` field to validate the signature instead 
  of performing signature recovery.

Is this merely a performance optimization? Is there a situation where the declared public key field differs from the public key that would have been recovered from the signature?

user51948: Recovery of a public key from an ECDSA signature is not unique. This is because the r value in a signature is only the x-coordinate of a point, so there are actually two points R and -R that have the same x-coordinate, and both will give a different public key. Actually, for completeness, you can even end up with four possible public keys - but this happens with negligible probability.
In bolt-11, a recovery ID which takes values 0, 1, 2, or 3 is used to specify which of these four public keys should be used. But indeed, it is more efficient to simply use the given public key n. I don't think there are other practical benefits other than efficiency and perhaps robustness in case something goes wrong during recovery. n should always be one of the keys recovered, otherwise signature validation will fail.

12987: <p>From Bolt-11:</p>
<pre><code>A reader
if a valid `n` field is provided:
MUST use the `n` field to validate the signature instead 
  of performing signature recovery.
</code></pre>
<p>Is this merely a performance optimization? Is there a situation where the declared public key field differs from the public key that would have been recovered from the signature?</p>
 51948: <p>Recovery of a public key from an ECDSA signature <a href="https://crypto.stackexchange.com/a/18106/49392">is not unique</a>. This is because the <code>r</code> value in a signature is only the x-coordinate of a point, so there are actually two points <code>R</code> and <code>-R</code> that have the same x-coordinate, and both will give a different public key. Actually, for completeness, you can even end up with <a href="https://crypto.stackexchange.com/a/60219/49392">four possible public keys</a> - but this happens with negligible probability.</p>
<p>In bolt-11, a recovery ID which takes values 0, 1, 2, or 3 is used to specify which of these four public keys should be used. But indeed, it is more efficient to simply use the given public key <code>n</code>. I don't think there are other practical benefits other than efficiency and perhaps robustness in case something goes wrong during recovery. <code>n</code> should always be one of the keys recovered, otherwise signature validation will fail.</p>
