Keys can come from 4-packs or from buying the game on third-party sites we give them to.
EDIT: However, there is no way to validate that a given key has not already been used. So I'd recommend against trading for keys with individuals you do not trust completely.