Is there some API to validate a GOG key without activating it? If there is one it shouldn't be too difficult to set up an escrow service:

* Both participants enter the keys and the games they correspond to, but they don't yet have access to the traded key
* The escrow service verifies the keys against the specified games and shows the results to each counterparty for confirmation (to prevent someone entering a key for a different item). If both keys are valid and confirmed, access to the traded keys is granted simultaneously

If the API is not available to the public, maybe GOG can be persuaded to set up the escrow page (perhaps with a nominal charge if the trade is successful).

It isn't completely trivial, there are some challenges (e.g., protecting it from scriptbots doing fake trades and using the service to guess valid keys) but it should be reasonably easy and would limit the chances for scamming