In general GOG does not sell keys. There are very few exceptions that I will mention but it is safe to remember GOG does not do that. If you are looking for a key you are doing this on your own risk - I do not recommend it. Steam seems to be the only store which allows keys to be given to other stores. Epic also does not allow that. The trusted stores are usually these who get their keys from the devs/publishers.

The few exceptions I mention are first "Gamesplanet". I have never used it or know anything about it but it is the only place I have seen to sell GOG keys and it says in their activation tutorial how to activate a key which suggest you are given a key. I cannot confirm if this is true or not but there are games with GOG activatation there. The other exceptions I know about are humblebundle and fanatical. Humblebundle sometimes has GOG bundles while Fanatical sells a very few games mostly from Bethesda. They both require to link your account - no key is given!

GOG got very few keys on a few platforms only, but even GOG is having some key offers at some other sites, as you may have noticed it. The sheer majority, by far... are Steam keys, indeed.

Gamesplanet is one of them offering GOG keys, yes. Humblebundle is as well legit, yes but it is primarily a "Steam" key reseller, very few other keys.

For Steam, even GOG or EGS it seems, i can recommend "instant-gaming" so far never had any issues with a key. There are many other sites of course... those are just some good examples.

Besides, of course EGS does "allow" key reselling, although just as GOG with a pretty limited selection on a few sites only.

What happens if a shop is not offering any key? Easy answer: They can "go home", because the customer demand for cheaper games is just to high. Not that i always enjoy it (i only use GOG keys if i get a present, from users or GOG) but this is the truth in the world we live today. Even Sony and Nintendo are now doing "cheap mass sales" on their own stores, kinda the same way GOG, Steam, EGS and what else are doing it... if they dont... they can as well "go home": It is their pillar of "high digital success" and they know it.

I saw the new initiative today: https://www.gog.com/en/gog-preservation-program

(essentially a fancy badge to show GOG has poked at a game)

The 'patch notes' for the GOG made improvements are down the right side of the store pages for games, for example with Dungeon Keeper II:

"What improvements we made to this game:
Update (13 November 2024)

Added missing localizations (DE, DA, NL, FR, IT, PL, SV) for a more inclusive experience
Resolved registry issues for smoother functionality
Fixed broken maps where creatures were not recruitable
Optimized configuration settings for better performance
Validated stability
Verified compatibility with Windows 10 and 11
Added Cloud Saves support

Internal Update (23 July 2018)

Updated internal installer structure, no changes to game files"

Which I use as an example because it's an interesting one compared to the "improved stability" ones: even though DKII wasn't a game on this list it does show that missing localisations could be returned to games via GOG's own tinkering which could clear out a little bit of the list and help chip away at the games that have multiple missing features.