it is legal (in the letter and sense of the law) but those grey market sites are use at your own risk because they source their keys from dubious sources.

If you get scammed (revoked keys, duplicated keys, keys not intended for your region, etc.) then you are out of luck.

If you are asked to use a VPN for activation or if a game is sold as a Steam account, then it's definitely not a legitimate sale.

If the site is not listed here
https://isthereanydeal.com/

Then it is not a legitimate key selling site.