I don't think bundle sites give out used keys knowingly. I'm not saying that mistakes never happen, mistakes do happen, sure, but it's certainly not widespread. You've said it yourself: you've bought over a thousand bundles over the years. How many keys is that? Hundreds? Thousands? And out of the lot, only 30-something were duped. That is definitely not a tendency.

But it's a fact that some devs and publishers sometimes revoke unused keys. There's even a thread about it on SG where people report bundle keys that turned out to be duped when they tried to activate them. Most often than not though, devs and publishers are at fault. That usually affect unused keys, as I've said, but I can think of one instance where already activated keys were revoked. Have you heard of the game Overfall? Because the dev team apparently had a beef with a publisher, they decided to revoke the Steam keys they had given to said publisher... that was about 30 000 keys. Just like me, a whole damn lot of people who had gotten their Overfall key through a Fanatical bundle had the game removed from their Steam library. That was quite the shitshow, let me tell you. Eventually, the dev team did send new keys to Fanatical so they could replace customers' revoked keys... Yay for a happy ending, I guess.

At the beginning of this summer, I tried activating a key for Lost Moon (renamed as Enigmoon), that key came from an ooooold Indie Gala bundle. I contacted IG, they told me it was the dev's fault. I contacted the dev... of course, he said the problem was on IG's side. However, after a few emails, he eventually admitted to revoking old, unused keys. ¯\_(ツ)_/¯ Since I was able to prove that I had paid for the key, he provided me with a new one.

My point is... You seem to think that when a "new" key turns out to be duped, it's the bundle site's fault because they resell keys they've already sold. Is that what you're implying? That bundle sites will knowingly sell the same keys more than once? If that's what you meant... No. Well... as I've said, I'm not saying this never happened. Mistakes happen, yeah. But I do not believe that bundle sites... well... reputable bundle sites, that is, would do that on purpose. From my experience (and also, look at that SG thread I've talked about earlier), devs and publishers are most likely to deactivate, revoke old (unused) keys. That's the real problem. And that seems to happen with the smaller, more indie devs / publishers.