There are a number of sites. I wont link them here because those sites ALSO sell stolen keys for games.
The Windows Keys, though, are almost entirely legit. They are simply purchased in bulk (OEM) in countries where the local currency makes them super cheap. Since MS decided with Win 10 not to region lock the keys, they all work.
You can even do it yourself if your credit card supports foreign currency transactions. Youll probably have to use a VPN these days as MS seems to have set up most of their websites overseas to detect if you are from elsewhere and set the price at an equivalent to your local cost. But you can buy straight from MS if for whatever reason you wont patronize the grey market.
As for wether or not they can legally be resold, the answer is yes. EU law requires it, and MS decided (like Valve did, with Steam refunds, which are required by EU law) to just make that policy world wide, rather than try to have two (or more) policies.
But, as Chazus said, dont buy anything else on the grey market. It was likely stolen or bought using stolen credentials. The Windows keys *used* to be that way as well, until people realized it was just as easy to do it legally (buy a 1000 OEM keys in bulk for 8$ USD equivalent each, resell them for 15$, pocket profit for virtually no effort).
And as to whether MS cares - they dont. Paul from Paul's Hardware did a video about it, where he straight up called MS and had them on the phone. They dont care. A Windows key is a windows key is a windows key as far as theyre concerned. If its an OEM key they wont give you more support than activating it, but they dont care.
And, as i said in the previous post...
You can also just install Windows and never activate it. The Watermark will be there, and you cant change a bunch of settings, but it works just fine. And MS literally does not care.