I’ve purchased a handful of keys over the years. It’s legit.
They’re OEM keys which are against EULA to use in this way. It might work now, but they could ban those keys later if they want to.
It's "legit" insofar as "it's gets you a string that you can enter into windows and will activate". I doubt it would satisfy any legal requirements, although to be fair a home user probably wouldn't be very concerned about that.
In Hungary you can get them as cheap as $7-$10, because of the EU regulation that you can't exclusively bundle hardware and software. Meanwhile the retail version is $91, for the cheapest Home version. Ridiculous.