Yes, the system account running roundup needs to have the keys available in
the default keyring, so you need to use "gpg --import" to import keys of
users, and you need to generate a secret key for the tracker on the command
line, too.

Allowing key updates via the web interface would need very good verification
so that keys only contain email addresses that are valid for this user.

And if a key (or encryption subkey) expires, you can't add new messages to
issues where the corresponding user is in the nosy list, so I have created
https://hg.intevation.de/adminton/file/default/shebang/gpg-keyring-check-expire
to check for keys that will expire in the near future.
I run this once per week via crontab.