How does ripple verify the signature?
You are correct about the first part.

Unfortunately, it's not quite possible to recover the public key from the signature. You can recover a public key that works for ECDSA purposes, but that doesn't guarantee it is byte-for-byte identical to the intended public key. That means it may not hash to the right address, which could cause the check whether the right public key was used to fail.