Does commit signing matter for a solo public project

It proves commits came from a key you control, which matters mostly for released tags and for actions others automate against. For everyday commits on a one-person project it is largely ceremony, and an expired key causes more confusion than it prevents.

Revert. It creates a new commit that undoes the change and leaves everyone else's history intact. Reset plus force push rewrites what others have already pulled, which turns your small mistake into everyone's afternoon.

Marginally. The real value of rebase is a readable history when many branches land per day. With two people the cost of the occasional botched rebase usually exceeds the benefit, so merge and squash on the way in is a calmer default.