I buy them from the company which makes the lock. If I need an extra key, I make it myself with the machine at my makerspace. People who give their keys away to keymakers and give them their addresses obviously have bad opsec.