FWIW, I am an American citizen and former military officer with a top secret clearance. I never broke US law, and I never feared any retaliation from the US government.
I was going by this which states that "importing technology" is covered by sanctions.
If encryption can get classified as munitions export (which, pre 1992 it was) I could imagine a PR from NK can fairly easily be classified as "importing technology".
IANAL but if I was taking a risk averse approach like this Iranian dude then I'd err on the side of caution and not merge.
I certainly wouldn't want to try and establish case law that a PR is not importing technology, either, even if, say, the lack of a financial transaction meant it technically didn't count. It's playing with fire.
More importantly, in the US, there is at least some semblance of fairness in the judiciary. To be clear, I'm not saying "fairness always wins". Not even close. A criminal charge would entitle the defendant to a trial by jury, though, and I find it hard to believe that a jury would convict a teacher for merely collaborating with a student in an academic setting, regardless of the letter of the law.
I'd feel only marginally more safe violating the US's equivalent law. Breaking sanctions means prison and, at least according to Amnesty, US prisons engage in torture pretty routinely.
So, I probably wouldn't merge a North Korean PR.
Would you?