I do commercial closed-source development; there is no public branch to the whole world. OTOH, all feature branches are public to the team; only trivial

I do commercial closed-source development; there is no public branch to the whole world. OTOH, all feature branches are public to the team; only trivial features involve a single developer. So your assertion doesn't seem well-formed to me. Actually you can still rebase, but you would benefit from having a separate shared repository for developing that feature, so that you can share rebases without rewriting history on the release remote. This makes it easier to manage public rebases, because you only affect those devs working on the feature, but more importantly it means that you still get the security because your release repository always maintains the integrity of its history.