What exactly do these keys do? What is being verified with GPG, and why is it necessary?
The keys are used to verify that the software you're downloading is what the author of the package intended it to be instead of trojan-horse malware from a repository server that may have been successfully infiltrated by an attacker. Or maybe an attacker can redirect your download request to his disguised malware repository instead of a genuine AUR repository. Verification by GPG makes it very difficult for an attacker to successfully use the software repositories as a malware distribution channel.
Why is it necessary to import keys by hand? Why can't it be automated?
You're supposed to make a conscious choice on whether you trust a particular software author/packager or not, and whether you're confident enough for your purposes that the key you've received is genuine and not from an imposter.
The necessary trust & confidence level depends on what you're doing: a private home system for fun, a server that will handle other people's health and/or credit card information for a business, and an ancillary support server for a national missile defense system should each have somewhat different requirements.
If blindly importing the key from the AUR comment thread is bad, what steps am I supposed to take to "verify" the key?
If the key is signed by other people whose keys you already have and you trust those people's judgement at least when it comes to signing GPG keys, you can take that as evidence that the key is probably genuine. Otherwise, you might try getting the key from multiple different sources and compare the results. If it's important enough for you, you might even call or meet the developer to get stronger confirmation that you have the right key.
Where am I supposed to find the key if nobody's bothered to post it in the comments, and if I don't have time to post a comment and hope the maintainer replies?
GPG public keys that are intended to be widely used are commonly published on SKS keyservers: if you don't have the right key, the package tools should be able to display the keyID of the required key, and you can use that to search for the key on the keyservers.
See here for more information on SKS keyserver network: https://sks-keyservers.net/
You can also google for the keyID.