Fellow #OpenSource developers: what do you do when you find out that a project you work on is used by an entity you consider ethically questionable? What if that entity submits reasonable contributions?

I think you should treat it as a community issue. Just as you don’t want to work with some people, you might want to not work with some organizations. If it happens to be the community’s majority view, elevate it to its CoC.