Green Man and fanatical are trustworthy because they purchase and sell keys as a proper retailer by buying keys from the devs.

Sites like g2a sell spare keys or dubious key sources, such as using stolen credit cards. Using a reputable seller like gmg is completely fine, g2a and the likes on the other hand often actively hurts the devs.