Microsoft themselves says otherwise -- that this practice is not allowed, and that there is no such thing as a secondary-market product key as large customers are supposed to discard unused product keys. These $10 keys frequently get revoked as Microsoft discovers them used outside of their intended setting.
I don't know why a site that is usually reputable (tomsHardware) has gotten the facts wrong on this.
There's no legal issue, but the possibility of having your Windows license revoked for an EULA violation definitely falls under "not legit". And if you continue using it after it's revoked, that will be a legal issue.
I don't know why a site that is usually reputable (tomsHardware) has gotten the facts wrong on this.