The leaker can always visit the SSL site via Tor, which would solve the problem.