Yes, in order for the key to be accepted, the user account needs a password set. Do (as root):
passwd user

The permissions for the ~/.ssh directory and authorized hosts files can be u+rw[x] but must be go-rw[x] (you may want to be able to update known_hosts if shelling out).