The article is a little disingenuous suggesting that the researcher was contacted by lawyers and police for reporting exposed keys. He did report the keys and t

The article is a little disingenuous suggesting that the researcher was contacted by lawyers and police for reporting exposed keys. He did report the keys and that was great. BUT... "To have a record of what he had reported, however, the researcher encrypted the data he had come across and securely stored it aside for 90 days, as a part of the coordinated disclosure process." That seems to be a slight more problematic thing. If this copy was only cloning a public repo then fine, but if it was using exposed keys in any way to obtain data outside the repo then that would likely be a crime.