I stand corrected. I guess it's reasonable for CDPR to merely state they don't know where the keys are coming from.
Still, all this jumping to conclusions is making everyone look a bit silly (myself included, up there). It'd be nice if GMG clarified first thing tomorrow where the keys are coming from. I sincerely hope they're not gutting retail copies to get these keys. I'd probably not use them again if that's the case, because as a customer you're running a bit of a gauntlet, especially if CDPR decides to deactivate the keys out of a fear that they're stolen.
This is what I think is happening. I can't see GMG buying keys from some shady seller, but I can see them buying keys from Namco, who are the retail publisher.
Now, whether Namco is knowingly breaching their agreement or not is another matter. It's probably just a mistake on their part; I can't see Namco being stupid and intentionally doing this, since they'd almost certainly be found out.