> the APK on the website is signed by a different key from the one that F-Droid updates itself with

Could you explain? I don't understand what you mean here. https://f-droid.org/F-Droid.apk is signed by the same key that signs https://f-droid.org/repo/entry.jar