The agreement is only between the dev and Valve; 3rd party key sellers like G2A or Eneba usually obtain their keys through trades, buying them from the original seller, or by stealing them (which is an entirely different can of worms). They’re entitely user-driven marketplaces selling second-hand merch.