They are legit. The second one I know for sure it's a site that tells you where to buy keys, not one that sells them to you.
There can be many reasons for cheap keys: people getting them for free that want to turn a profit, purchases in bulk from developers during big sales and fiscal havens. They are all legal and legit, except maybe the fiscal haven thing. But hey, Amazon does so and everyone buys from them, so why would you worry about that?