The ONLY encryption my App uses is calls over HTTPS. Currently (7 June 2017) iTunes Connect requires an Export Compliance according to this information in iTunes Connect.
<
I unfortunately do not have enough rep to comment but at the minute I am looking into the exact same issue and I believe that you are correct when you say that you can set the ITSAppUsesNonExemptEncryption key to false, at least this was the conclusion I came to from my research.
For the self classification report it does look like you have to submit one by February of next year, I found this link helpful in explaining the report and what to do
https://www.bis.doc.gov/index.php/policy-guidance/encryption/reports-and-reviews/annual-self-classification
Like I said this is all from my own investigation like you and I think this is correct but if anyone does have any more information would be greatly appreciated.