Does Arch use public keys to install software from repositories?
 

Like Debian and Debian-based distros do.

No. This has been a much talking about topic - you can read about it on the Arch mailing list archives. Everybody seems to think it's a good idea, Arch-devs included. The current discussions are just on how exactly to implement it. The packages are checksummed however, so if you trust your mirror, at least you know the integrity of the package before it's installed.