Sorry, man, I'd recommend you re-package with a new key, and re-publish. There are numerous sites that log all Github commits, that private key is public now.

Sorry, man, I'd recommend you re-package with a new key, and re-publish. There are numerous sites that log all Github commits, that private key is public now. Anyone could sign any other extension as you now.