No, you can sell to the appropriate folks who will effectively launder the legal risk for you. Someone like Hacking Team.

Hacking Teams exploits were released and they are nothing like the one in this blog post.

There is a gov (or close enough for Hacking Team/peers work) out there interested in stripping passwords from the most privacy sensitive individuals, who likely heavily overlap with activists.

That's disingenuous. It's still illegal for a citizen to do this.

Selling it to sketchy vendors and doing "see no evil" appears to be perfectly legal. Unless you have some data otherwise?