As a developer who didn't do this. I went the other way and gave people steam keys anyway. I want to ensure you that this is the right choice. Dealing with scammers and people who clearly just want to support places like g2a and their own wallets over playing a wonderful game. I fully regret allowing my own steam keys to run rampant even though it felt like the "right" thing at the time, the real right thing is to be protected from scammers.