Because Google holds the actual app signing key separately, we could reset the upload key through the Play Console. A few days of back-and-forth โ but the app survived.
Lesson learned: Store your .jks passwords in a password manager. And enroll in Play App Signing from day one