Are you familiar with anyone who has ever gone to prison for selling an exploit to a third party? What were they charged with? You may not be interested in the kind of attention you'd get from intelligence or law enforcement, but as far as I know the act itself is legal in most/all jurisdictions.