Yes that is correct. You set the permissions you need in the AndroidManifest.xml by adding a <uses-permission> tag for every call that need special permissions to run.
Here is a example
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.android.app.myapp" >
<uses-permission android:name="android.permission.RECEIVE_SMS" />
</manifest>
Whether you are granted the permission is up to the user at install time where the user is prompted to accept or decline your permission requests. This question will not be asked at runtime.
If you get denied the permission a security exception MAY be thrown so be watchful for that.
Read more about it here
http://code.google.com/android/devel/security.html
For your question on certificates there is quite different from J2ME. Every application MUST be signed but the certificate does not have to come from a certificate authority so self signed apps are ok to use. With J2ME the cert will grant you different right but this is not the case with Android. All its for is to develop trust relationships between applications, so to allow different apps to interact with each other.
Hope this will help.