Do the JSON keys have to be surrounded by quotes?

Yes, you need quotation marks. This is to make it simpler and to avoid having to have another escape method for javascript reserved keywords, ie {for:"foo"}.

You are correct to use strings as the key. Here is an excerpt from RFC 4627 - The application/json Media Type for JavaScript Object Notation (JSON)

2.2. Objects

An object structure is represented as a pair of curly brackets surrounding zero or more name/value pairs (or members). A name is a string. A single colon comes after each name, separating the name from the value. A single comma separates a value from a following name. The names within an object SHOULD be unique.

object = begin-object [ member *( value-separator member ) ] end-object

member = string name-separator value

[...]

2.5. Strings

The representation of strings is similar to conventions used in the C family of programming languages. A string begins and ends with quotation marks. [...]

string = quotation-mark *char quotation-mark

quotation-mark = %x22 ; "

Read the whole RFC here.

From 2.2. Objects

An object structure is represented as a pair of curly brackets surrounding zero or more name/value pairs (or members). A name is a string.

and from 2.5. Strings

A string begins and ends with quotation marks.

So I would say that according to the standard: yes, you should always quote the key (although some parsers may be more forgiving)

Yes, quotes are mandatory. http://json.org/ says:

string
    ""
    " chars "

Yes they do. But if you need otherwise, checkout JSON5.

JSON5 is a superset of JSON that allows ES5 syntax, including:

• unquoted property keys
• single-quoted, escaped and multi-line strings
• alternate number formats
• comments
• extra whitespace

The JSON5 reference implementation (json5 npm package) provides a JSON5 object that has parse and stringify methods with the same args and semantics as the built-in JSON object.