We're not worried. Our operation is anonymous, and as long as we don't slip up, we'll be fine. Though saying "don't slip up" is very "draw the rest of the owl"; it's most of the work: https://news.ycombinator.com/item?id=37346620

But we'd like to do the right thing ethically, which is hard to figure out.

Hypothetically, if you were going to set up a process for yourself outside of the law, what criteria would you use?