Where are your instincts wrong?
I’m not sure the full list of things here yet, but there’s definitely a bunch of them.
Why? I think this is the basic “don’t burn yourself on the frying pan” of web literacy. It’s almost irresponsible to teach cooking without it.
Why not? Getting a comprehensive list of these things is going to be hard and teaching some of them is also going to be hard. Are these more “web citizen” skills or “web maker” skills?
Identity
Who are you when you do things? What is anonymous? If you create a pseudonym for yourself, where is it linked to? That whole map.
Why? This is a big place where people’s instincts are wrong (see above), and it’s also hard to back-track on identity once you’ve made mistakes here.
Why not? I can’t think of any reasons why not. 
These three skills are sorta a cross between “Privacy and Security” and “Create Content”:
Public vs. Private
What information is available to everyone? What is available to some people? Who (eg: website providers, etc.) can see even the “private” stuff? What is one-to-one messaging versus one-to-many broadcasting?
Why? Choose your proper audience. Reduce privacy slips. Think about how important this is to activists in zambia.
Why not? A little information here can be dangerous. In a lot of ways “assume everything is public” is safer/more realistic than the assumed-private of some teaching. So this can be tricky.
Ownership
If you link someone else’s image on your page, and I take a screenshot of your page, who owns the screenshot? Me, you, or the image-author?
Why? Anyone making things on the web should be aware of these issues. Especially in a remixing culture.
Why not? It’s complicated. Unfortunately.
Permanence
If you make something “online”, how long is it there for? Where does it “live”? Can you “delete” things, and if so, are they gona completely? What if you change something?
Why? This is a big area where people’s instincts are wrong.
Why not? It may not be a “necessary” topic for being a web maker.
Web Literacy vs Web Citizenry vs Webmakingery – Such a doozy. This discussion has been rattling around in my brain for a while, and I’m having a hard time rectifying it. Our instincts are different depending on how we fit ourselves into these categories and how we distinguish between them.
That leads me to identity – virtual vs real identity, how they’re different, how they’re the same, how the digital age has changed what identity means (for those of us that spend a lot of time on the web). Philosophical freakouts can result from that identity question (whether you’ve ever been online or not!) That map is super important, but not just on the web, in life.
Public vs Private – Unfortunately, assume everything is public is the only way to responsibly teach this concept, IMHO. Even encryption experts and highly funded government organizations can’t keep all their private data private. It can get out, always.
Ownership – Complicated issue, especially because the laws are different in different countries. Maybe instead of helping people understand who owns what, we help them understand attribution and copyleft ideas (with a disclaimer telling them they need to check local laws and regulations)?
Permenance – sort of fits in with public vs private and identity. Maybe it’s a theme that runs throughout webmaker / web literacy programs?