Just beat the Giant Rat once. It drops automatically when you do.
Sewer Dungeon, Floor 5.
I didn't get to give him the key but you can still find the fake and beat him outside the city so I guess it is reversible ?
No, but it doesn't really matter tbh. They'll run off when you rescue the real blacksmith but not with the entire inventory.
You can find the bandit later outside of the cathedral dungeon, just past the bridge and towards the back of the open field.
