gmg and gog are resellers and have deals with publishers. they distribute keys in same way steam does. they are 100% legit.
g2a/kinguin are markets where game keys are sold. they can come from anywhere and anyone can sell them (including me and you). obviously someone got hold of bunch of grey keys, which are mostly used for promotion, given to press. if they were obtained by paying with stolen cc or taken from stolen box shipment (my DI key was like that), valve would remove them by now. they send you red message in inbox to inform you that key was fradulent. if they dont know whos guilty you might end up banned but in cases like mine where key trader fucked over bunch of people from multiple closed accounts (was closed second after we made trade), valve won't bother you.
steam/origin/uplay/gmg/gog = digital store
g2a/kinguin = ebay