Well, this appears to be one of those non-obvious behaviors that cause nothing but headaches: the internal logic adds a rel attribute to the link that then causes the sanitizer to strip the link out entirely.
Fortunately, there's an easy work-around, and since only like two people ever use this tool it should be easy enough to remember. I've fixed this one & will do a spot-check on other blacklist entries to ensure they work too.
Thanks for the report. Kudos to bluefeet for asking around about it internally and Adam Lear for diagnosing the root cause.