This is only for apt systems, other package managers will be different.
Are they stored all in one place?
Do you mean the package archives or the files pointing to the repository? Package archives are stored in /var/cache/apt/archives. The specific repo files or entries are stored in /etc/apt/sources.list or /etc/apt/sources.list.d/*.list. Note that there is no necessary connection at all between where a repo is listed and the file that contains that listing. You could have, and in fact, Debian used to default to, most of the repos in /etc/apt/sources.list for example. Or you could have a repo from google in an opera.list file, the file names don't matter, what matters is the .list. But to make matters more predictable and maintainable, it's not a bad idea to make the repo filename correspond to the actual repo it points to.
Is it possible to see like what repositories I have added over time and when
You can see what repositories, I use inxi because it's easy.
inxi -r
Repos:
Active apt repos in: /etc/apt/sources.list
1: deb http://mirrors.kernel.org/debian unstable main contrib non-free
2: deb http://mirrors.kernel.org/debian/ buster main non-free contrib
3: deb http://security.debian.org/debian-security buster/updates main contrib non-free
4: deb https://liquorix.net/debian unstable main
5: deb http://www.deb-multimedia.org/ buster main non-free
Active apt repos in: /etc/apt/sources.list.d/google-chrome.list
1: deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main
Active apt repos in: /etc/apt/sources.list.d/opera-stable.list
1: deb https://deb.opera.com/opera-stable/ stable non-free #Opera Browser (final releases)
You can also do:
cat /etc/apt/sources.list /etc/apt/sources.list.d/*.list
but that's harder to read, harder to type, and not as clear as to what file contains what. inxi is made to show that information cleanly.
The only way you can see when you added them I believe is if you add individual repo files, and then look at the file creation timestamp. There may be another way but I don't know of it.
Where are the keys stored
Good question, never thought about it. I'll see if I can find that one out.
According to: https://wiki.debian.org/SecureApt
they are found in /etc/apt/trusted.gpg.d and the file /etc/apt/trusted.gpg
ls /etc/apt/trusted.gpg.d -w 1
debian-archive-buster-automatic.gpg
debian-archive-buster-security-automatic.gpg
debian-archive-buster-stable.gpg
debian-archive-jessie-automatic.gpg
debian-archive-jessie-security-automatic.gpg
debian-archive-jessie-stable.gpg
debian-archive-stretch-automatic.gpg
debian-archive-stretch-security-automatic.gpg
debian-archive-stretch-stable.gpg
deb-multimedia-keyring.gpg
Comparing the repos I have with these, it looks like at least some of the repos are in fact stored in /etc/apt/trusted.gpg, and that's a non zero file size file.
Again is there any way to see which and when I added over time
Same question, same answer.
If I don't like the software is it important to remove them?
You should, to avoid clutter, and to avoid having to grab the repo data on apt-get update every time when you don't actually need that data. Plus random repos can and sometimes do just vanish or change or break, at which point you'll have an annoying apt update failure to debug. Also make sure to use apt-get remove --purge to avoid leaving configuration files for software you really don't want on your system. Without the --purge option, the configuration files are left in place.
With this said, pay attention to what Michael Horner said in his comment, that is the actually correct answer in my opinion if security is your main concern.