Most of the key sites are reselling bundled keys, doing region nonsense or are outright fraudulently purchased and laundered. There's a blog post from an indie studio that is roughly titled "don't buy our game from those sites, please just pirate it instead"