The keys were given in plain text to this intermediary at some point. A copy of said text should exist.

The Steamworks Documentation explicitly recommends tagging the keys to keep track of them and potentially prevent this kind of issues.

They don’t know the keys on G2A

But they should. Someone at RWS generated those keys and then sold them to resellers. Even if they don’t personally keep track of the keys, Steam probably does.

I guess they don’t want to affect users who already paid for a key even though they have the right to do so.

Honestly, I’ve had keys revoked from my account before, and it sucks to waste money on scammers, but any rational person would understand that’s not their fault.

Hold on a minute. Developers need to generate the keys so third parties can resell them. And they can revoke or disable them if they were obtained fraudulently.

What is the point of all this? Just disable the keys and fuck the scammers.