Yup, all of your assumptions were correct.
To get the key installed make a new directory and run "repo init" there:
mkdir ~/new
cd ~/new
repo init git://
android.git.kernel.org/platform/manifest.git
cd ~-
rm -rf ~/new
You don't actually need to run repo sync here. The repo init process creates ~/.repo and installs the public key from the repo wrapper script into a hidden GnuPG keyring under ~/.repo. Keys on that keyring are trusted for automatic upgrades.