Previous keypair was accidentally committed to git history. New keypair generated, GitHub Secrets updated, pubkey rotated in tauri.conf.json. Old key is now invalid for signing — any releases must use the new key.