Yeah I did consider that people are going to share keys, but people are going to share accounts too so that's always going to happen. The best thing you can do is stick some safeguards on the keys where if a key is found online, it can be deactivated and potentially investigated since you can tell which shop sold the key. If there's a shop out there just giving cards away to minors, well they're in for a world of trouble.
Under the Licensing Act of 2003, it's illegal to sell alcohol to an adult if you reasonably suspect that they will be then giving that alcohol to a minor. You can assume the same will apply to people selling Wank Cards.
Maybe you could limit the number of verifications a key can have in a day? Limit it to say 10 verifications per day. So if you're on Pornhub and have an account, you can have the key associated with the account, verified, and so you don't need to re-verify. But if you go on 10 completely different sites and verify for each one, you can't verify after that 10th one within the same 24hr period?
You could maybe also include guidelines for integration where if a key is associated with an account, that key can't be used for any other account. You can include that under some requirement that says you have to make 'best efforts' to ensure that a key is only ever used by one account at a time. That way, if a million people are sharing the same key, you'd have to trust that all one million of them will never associate that key with their account because if they do, it invalidates that key for every use other than through that account on that site.