What are approaches to forming solid relationships with security researchers?
For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk related to security standard practice?
Here are several steps you could take to encourage security researchers to disclose vulnerabilities to you:
You can't form good relationship with security researchers.
The first problem is within your own company. When they report a bug, employees in your company go into a denialism phase, trying to prove it's not a bug. It doesn't matter how you feel, even if you are the CEO. One reason for this is that indeed, most vulns reported by security researchers are bogus. You have to sift out the valid vulns from a large number of invalid vulns.
The second problem is that most researchers who report vulns aren't interested in a "solid relationship". They will twist the vuln and your response to it in such a way to prove that you are a bad, stupid company.
The two most important things are first, that you use a standard email address ("email@example.com") that they can submit vulnerability information to, that has a responsible person on the other end that will respond within one business day. The second thing is that your train tech support so that when they get a report of a security vuln, that they don't demand that the person be a customer. (That's the most common problem: a researcher calls tech support and reports the vuln, then tech support ignores them because they aren't a customer).
Beyond that, expect that vuln reports will end badly.