Don't buy a key from a key reseller and always expect it to work. You can't actually check whether a key is legit or not. On these kind of sites you can't get your money back. Just buy a key from an official site and if the key doesn't work they'll always replace it. You may be spending less money on key reselling site, but you'll soon realise that you wasted it.

You could, for some Witcher games, but I believe CP2077 is just a code-in-a-box.
It's really not that rare; the reseller sends you a scan of the code sticker on the manual or the inside of the box (usually for retail boxed games that need Steam activation).

Sure, sounds likely to me to... I wasn't trying to argue that.

Since I have a retail copy I can answer that: No.
The only CD's in the box are Soundtrack CD's.

However afaik box keys get sold to resellers anyway, even if already used, and when the resellers customer complains they tend to tell the customer to get the activation date of the key from the Steam or GOG Support (or whatever platfrom it is), so that the reseller can offer a refund or a new key.
The activation time is of course totally irrelevant and an info support staff most likely won't provide - and the resellers know that. It's their way to screw with naive people and make them give up on making refund requests.