are these windows activation sites like SCDkey legit

Lars - I don't know if this helps clarify what is really going on - I stumbled on this thread when I asked the same question you initially did, which is HOW can they sell these so cheap?  So this is personal real-world experience with one of the major vendors, SCDKEY.com.  To start off, note that they accept FIAT currency, visa/mc/paypal/echecks - not some fly by night shady character at a flea market selling dvd-roms with license cards from a copier or ebay scam or darkweb bitcoin transaction.  If they were involved in what people have speculated, such as buying a wholesale license for 5 installs then reselling that license 5 times to 5 people - the chargebacks on the credit cards would ruin them, and no doubt expose them to prosecution for blatant piracy.  I found another game-selling-company mentioned in a youtube video about assembling PCs and buying a win 10 home lic for $8-10 where that other seller sold "insurance" you could buy to guarantee a new code if yours is used up and doesn't work for some strange reason.  That was really sketchy so I went looking for more "reputable" license stores, which is how I ran across SCDKEY.com.  They don't offer to sell you "insurance" on a bad code, which made me feel a whole lot better working with them.

Earlier this year, I bought a 2018 HP spectre x360 with win 10 home, and opted not to buy the $70 HP factory upgrade to pro.  When I got the machine, I shopped around, and bought the full-retail equivalent license for win10pro fresh install from scdkey which was $21 and good for ~5 installs on 5 PCs in the same house.  I'd built my desktop from scratch, so it needed a full install no matter what.  I installed my desktop, new laptop, and 2 other win10home systems with the full win10pro retail for $21, yielding 4 installs/upgrades for $21.  This was 4 months ago.  I recently got a used laptop given to me which came with win10home - and when I used my old key from SCDKEY - it still had 1 install remaining, so used the code a 5th time, and got the entire 5 installs with no over-selling.

Having had a good prior experience, and feeling like it was legit enough to use again when I needed 5 copies of MS Office 2016-PRO, I went back to scdkey, logged in with my ID to scdkey and sure enough they had the records of my last purchase online - so I bought the 5-pc lic for office 2016-PRO.  This license requires a Microsoft account to tie to it, so I used the same one I'd used for win10pro, and once again it worked fine.  Microsoft associates that license with my windows ID and nobody else's.  I got my 5 systems installed and registered on Microsoft just like if I'd bought office 2016 from a retail establishment - total cost was $31 for a ~$209 program.

So, my experiences have been purely positive.  If I could get deals like this on Adobe or other vendors, I'd buy more software.  Microsoft certainly could run out and kill those licenses, but they have not chosen to do so.  Since nobody here is a Microsoft marketing manager, for all we know, this may be their business model to dominate the op-sys and office software space.

The rest here is pure speculation on my part.  I know HP makes money selling win10pro at $70, which is less than Microsoft offers an "upgrade" - but - hp must support that sale, and NEVER let this customer call Microsoft (who will hang up after telling you to call HP).  Perhaps scdkey is claiming to be an OEM, and knows their clients are self sufficient enough to not need handholding?  Maybe they have a corporate license, and give you a login to their website as an "employee"?  Again, just me speculating.  What I can say for certain is that SCDKEY.com is in the business of selling discounted software licenses, and they know what they are doing.   They've been doing this for quite a while, and making money at it - so hopefully they'll be around when I need my next licenses.

Xavier

In the European Union it is perfectly legal to resell licenses that you don't need (Court of Justice of the European Union PRESS RELEASE No 94/12):

https://curia.europa.eu/jcms/upload/docs/application/pdf/2012-07/cp120094en.pdf

As far as I know most of the keys on platforms like SCDkey come from volume licenses that companies bought in the first place and then did't use the full volume. So they can sell not needed licenses to 3rd parties on platforms like SCDkey. As far as I can tell (I am not a lawyer) this is perfectly legal even if companies like Microsoft and Oracle don't like it.

I don't know how it looks like in the US.