Is the payment sites legit, and do I get the keys and downloads???
is fastspring legit?
Yes, Fastspring is Virgil's Payment processor. Follow the links from the main Knuckle Cracker site. Make sure your browser isn't being hijacked and that the windows aren't opend in iFrames.
If you're worried about buying directly from the dev, you can also use Steam, if you trust them.