As an amateur correspondent myself, the correspondents I’m concerned about doing right by would be other visitors to their site who click my link. I’m protecting link-clickers from my source, and my source from others. In this case, I’d view 'tptacek as both as my source, and as a potential operational security concern to me as an investigator due to not knowing them well enough to know their motives, and not knowing who is watching them and everyone who visits their site, which is the larger and more legitimate concern about doing security research, in my view.