...
"Whoever signs first is the owner" - this is so freaking wrong. So this means that all the Satoshi mined addresses are freebies, right? They don't belong to anyone? No, they belong to Satoshi, he did the effort to mine them. Exactly the same thing in this puzzle: the coins belong to the creator.
...
If someone would share the sha256 of private key which was in bytes or hex, then make the tx and the tx was replaced - he could prove that he had pvk.
One is that sha of pvk shouldn't be well known, this is reason why you need it to be unknown totally.
Second if he would share the sha before making the tx - he is the owner of laying funds.
You can't attack both.