I bought a cd key for like £4 from one of those dubious cd key sites. It worked flawlessly. I don't know how legal that is exactly (the internet isn't exactly clear on how those sites obtain keys), but tbh it's good enough for me and has no risk of malware. I figure Microsoft could easily block such keys if they wanted and they haven't.