Public key that was hashed to create your address is not public until you create a transaction spending funds from that address. Following one transaction one address rule ensures that at the exact time you reveal your public key to the public, you also spend all the funds associated with that public key/address.
To elaborate. Each transaction output contains a locking script that specifies the conditions that must be met in order to spend the output in the future. There are lot of different locking scripts that can be used, the most frequent one being Pay-to-Public-Key-Hash (P2PKH) locking script. It looks like this: OP_DUP OP_HASH160 <Public Key Hash> OP_EQUALVERIFY OP_CHECKSIG, where OP_... are so called script operators and <Public Key Hash> is an address of recipient. In other words, when someone wants to send you some Onions, he doesn't need to know your public key, it's sufficient that he knows your address.
When you want to spend an output encumbered with P2PKH locking script, you have to include this unlocking script in your transaction: <Signature> <Public Key>. In other words, you have to include your digital signature as well as your public key into transaction itself.
