1.when I want to sign a message, do I must have the private key?
Yes.
You sign message to prove that you own the private key. If it was possible to sign a message without the private key, it would defeat the purpose of signing message.
2.any one can using just public key to sign a message?and pass verification?
No.
You will need the addresses derived from the private key and the signature to verify the signed message.
3.is there any trusted site or tool for signing?
You can use electrum.