I see the current postinst does apt-key add - <<EOF rather than the standard way which would be to just ship a file in /etc/apt/trusted.gpg.d/ instead, in the same way as you are doing for the .list file.

This also ensures the key is removed when the package is purged.