They're probably foreign keys, and they're probably legit. It's a grey area, but as long as you're not using VPNs to buy foreign keys, Valve's not going to do anything about it. Peeps on GAF buy/trade these keys all the time, and no one's ever got in trouble for doing it. (I've done it once or twice.) At worst, if it gets too bad, publishers will just pushing for more region locked keys (some do it now, some don't).