Well, no matter what other applications for Tornado Cash may exist, since yesterday it is illegal to interact with Tornado Cash or assist them in any way for anyone within reach of USA jurisdiction. That's it.
Privacy as such is not illegal, but that does not mean that government may not prohibit certain specific ways of achieving privacy.
Yes what you are saying is true and it is our right and duty to protest that decision. When will they sanction something you do like and need like Signal or cryptography? Are they aware of all the bad that comes about via http? Or cash?
Well, the big legal limitation for these sanctions is that they apply only 'across borders' as OFAC can only sanction foreign entities (e.g. in this case asserting that TornadoCash-as-organization/project is controlled by North Korea), prohibiting U.S. citizens and companies from dealing with or assisting that foreign entity.
There are a variety of sanctions mechanisms. Tornado didn’t have to be controlled by North Korea (it isn’t), just used by them to fall afoul of U.S. law.
This is breathless but misleading. With recent conservative judicial decisions the notion of general privacy is on the ropes, but KYC has always precluded financial privacy at any scale other than unstructured cash transactions, and you're still supposed to report those in your taxes. This is in line with the treatment of other entities that fail to maintain KYC compliance.
The state has the power to levy taxes and prevent transactions with entities that it considers harmful (OFAC is effectively this); this is the state taking steps to do so, while GitHub is deciding that people who are attempting to evade those laws are outside the risk profile of "who we want to provide services to".
Privacy as such is not illegal, but that does not mean that government may not prohibit certain specific ways of achieving privacy.