Why do I need to add a GPG-key with apt-key before adding a download URL to apt/sources and downloading-installing with apt-get install?
The reason is simple: security.
First, if you don't do this, apt-get update will whine that some keys aren't found, and it downloaded "untrusted" package lists. If you do apt-get install it will ask you twice with big letters that you are installing packages from a untrusted sources. To any user this warning would be alarming (if they read them), so to prevent "How to solve 'NOPUBKEY' found" and similar questions, repository owners often include how to add their keys before even starting so users don't miss this step.
Second, if you miss this step and ignore the warning, the security is incomplete. You downloaded some packages list from a site you didn't verify. Any crack could have been exploited by someone, then tricking you into installing malicious software. If you added the keys since the start, you will have start-to-end secure transactions with the repository maintainer.
Third, when you add a key, it means that you trust that key. You say the system that you trust the person that identify themself with that key, and you want to install software from him.
