The issue here seems to be what's recognized as a "legitimate" key and what's not. There are a number of potential scenarios here with various levels of legitimacy:
1) Keys straight from publisher in region (ex. EA keys from Origin, Ubisoft keys from UPlay, indie devs giving away keys or selling on their own, etc.). 100% genuine article, no questions of legitimacy.
2) Reseller getting keys straight from publisher in region. This covers places like Steam and Humble Bundle, Origin and UPlay for third-party publishers, and so on. We assumed until now that this also covered Green Man Gaming. It probably still does for most of their games (WB Support has both confirmed and denied this is the case in separate conversations, for example). Essentially the same thing as #1 but with a middleman.
3) Reseller getting keys from authorized key distributors in region. One example of this happening is places like Costco selling PC game keys through a distributor, Codes2Go.
Ubisoft lists Solutions2Go as an authorized distributor to Costco and Walmart, so I assume Codes2Go is owned/operated by Solutions2Go (though oddly I can't find mention of Codes2Go on the site). Essentially the same as #1 but with more middlemen than #2. It's unclear if GMG fits into this category or not for the Activision and Ubisoft cases. It's also unclear as to who qualifies as an authorized distributor or not. As an example, Staples in Canada also sells PC games via codes distributed by Codes2Go, but they're not on Ubisoft's list of authorized dealers.
4) Reseller getting keys from authorized key distributors, but out of region. This is the scenario others in this thread assume is happening, which would explain the pre-order discounts GMG is able to offer on big games. (Pre-order discounts shouldn't be assumed to be a smoking gun, however, or else Amazon and Best Buy in Canada would also be suspect due to their E3 promotions.) This is legally murky, as you'd expect from the practice's more common name, "grey market." Certain publishers on Steam have begun locking their keys to specific regions to enforce regional pricing.
5) Reseller getting keys from authorized retail sellers in the form of physical games. There was another key reseller who said they were essentially buying up pallets of physical games and cracking open the cases to pull the keys. (I don't recall if they also destroyed the discs afterwards.) GMG hasn't said anything about this being their source, but it would fit the language of buying from "authorized resellers." There's an additional wrinkle here in that the physical games may or may not be from the same region.
6) Reseller getting keys from unauthorized key distributors. What even counts as an "unauthorized key distributor?" Who knows? One potential example, though, would be keys given away in bundles and other promotions that are not intended for resale--i.e. Nvidia/AMD graphics card bundles. Hard to say what the law says about this kind of resale. Another example is individuals buying up Humble Bundles and selling individual keys at a markup.
Polygon has discussed this practice in the past, and many assume this is where many G2A keys come from.
7) Other nefarious plots. Purchases on stolen credit cards have already been mentioned. There may be other examples but I'm not creative enough to come up with them.
8) Other not-so-nefarious plots?
The issue here is that beyond "publishers work directly with these stores," we don't really have any idea of what constitutes a legal sale of a game key. Since the only likely enforcement of any authorized resale regime will come from publishers themselves, and because there's a wide chasm between what they say (only buy from these stores) and what they do (many keys outside that ecosystem work, but many do not), it's hard to know what to do. It feels like for now, what determines legitimacy is as much up to the individual as anyone else.
