Per their site:
Tomb generates encrypted storage folders to be opened and closed using their associated keyfiles, which are also protected with a password chosen by the user.
because pass tomb is
Asking for a gpg identity and not a password
Created to keep your password tree encrypted when you are not using it (source)
they must be using the gpg public key to encrypt the tomb key.
If that's the case then no, having only the tomb key and the tomb aren't enough to access the tomb (unless they've broken gpg). If someone had the tomb, the tomb key, and the gpg private key they'd have not only the tomb, but the password files as well (since the same gpg identity is used to encrypt them).
You could always test by generating a new gpg keypair, creating a pass tomb using that identity and deleting the private key to be sure (don't trust me, I'm just some person on the internet).