Because I'm adding OMV onto an existing Debian install.
Can't you just remove the docker.list you added? This is a bunch of code to add and maintain that will help very few users and slow down the salt run.
Otherwise there are two sources in conflict, the other is in docker.list and uses the key, while the omvextras.list entry doesn't.
Using the key is not required if the armored key is placed in the trusted keystore location. I know the docker docs tell you tell but the saltstack code is doing the right thing given the key to download and the repo to add.