I've just used cd keys bought online, always worked fine, I tend to go with the more "reputable sites" that are advertised on relatively well thought of YouTube channels (ltt, GN, jayz, Paul's hardware etc have all advertised certain sites at some point) I'd have thought I'd they weren't legit Microsoft would be crawling all over them with lawsuits. Im not sure how they get the licences and are able to sell them so cheaply, but they always work