Sorry, man, I'd recommend you re-package with a new key, and re-publish. There are numerous sites that log all Github commits, that private key is public now. Anyone could sign any other extension as you now.
[deleted]
Did you just publically admit to attempting to break into his server?