Из подписи и сообщения восстанавливается публичный ключ.
It's also very interesting how that function works. Verifying a signature in public-key crypto requires the public key, signature, and message, right? But if you look at that sign message screenshot, you'll see no place to put/get the public key. (Bitcoin addresses are public key hashes -- not usable as public keys.) So how does Bitcoin verify the signature without the public key? It uses a unique property of ECDSA which allows you to calculate the public key from the message and signature. Bitcoin is, AFAIK, the only program that uses this property of ECDSA.
