There is no "not exactly legal". It's either legitimate or it's not. Officially sanctioned and supported by merchant law, or not. There is no grey area, because when it falls in the grey area, that means it's questionable. When it's questionable, that means it will end up on the Microsoft blacklist sooner or later. If you buy through a reputable vendor, and buy a genuine license, you will not have these concerns. If you buy a shady license, get it revoked, and then still have to buy a genuine one, you'll end up paying more than if you had simply bought a genuine one to begin with. End of story.