Okay, but suppose the signature wasn't reversible, you can still just run the signature against your public key to check. The nature of a signature is that it can be easily identified as originating from you.
Strictly speaking, as normally used, the nature of a signature is that given a message, a public key and a signature, you can determine whether that public key produced that signature for that message. The public key is an input.
For some algorithms, as Sophie described, the public key is a redundant input.
But it is reasonable to use the more strict definition and ask when the public key is redundant.
For many current applications, the input is really a message, a signature and the identity of the sender. You are expected to look up the public key with the identity in a global table and follow a chain of signatures back to one of a few trusted roots. In such applications, the public key is obviously apparent in the message itself, but there are many applications where you would like some measure of anonymity. In those cases, all you get is a proof that SOME valid key signed the message in question, but you can't know WHICH key.
Yes, but the public key does not actually, contrary to its name, have to be known to the entire world.
As the article shows, in many signature primitives it's necessary to assume it is (or at least visible to everybody able to view plaintext message-signature pairs signed by the corresponding private key), but primitives that don't have this property might be usable as native (and by extension more efficient) designated verifier signature schemes.
