Blocks are not signed.
In Signet they are. See BIP 325.
I noticed that difficulty and nonce is not signed in the signet. That means everyone can create a block with better nonce. Difficulty cannot be changed, because timestamps are signed.
For example, the first block in the signet has 00000086d6b2636cb2a392d45edc4ec544a10024d30141c9adf4bfd9de533b53 hash and 0x0007f4cc nonce. But that nonce can be changed, for example into 0x00110241, then 000000096a1c4239d994547185c80308a552cba85d5bd28a51e9dc583ae5eadb is the correct block hash. And if some client don't know about the first hash, then it can receive the second one and assume it as valid.
But what about deeper reorgs than one block? Is it doable by anyone or only by signet creators?
Because the previous block's hash is included in the signature, deeper reorgs can only be done by the block signer(s). In order to do a reorg of multiple blocks, after the fork point, the new block headers would have different block hashes in them, which would necessitate new block signatures in order to make them valid. Since only the block signers can produce valid signatures, only the block signers can make such reorgs.
Additionally, the one block reorg would quickly become stale once the block signers extend the chain.
