It's pretty clear that there are some places to just write off (Libya .ly, io, ga, etc.), and then, if you have anything even vaguely questionable, use a domain name in your country of operation.
If you're operating from NZ, you're already exposed to NZ law. A .co.nz domain name adds no additional risk. You may need to pick your country based on favorable laws -- i.e. don't run a gambling site from the US, and don't be a US citizen. HK is actually one of the better choices. The US is actually good for a lot of things, too.
If you're in the US, .com/.net/.org are all roughly equivalent, although I still think .com is the best overall tradeoff. There are some differences in individual registry ToS, but every one I've read is flexible enough as to be meaningless if they want to do something.
It's probably fair to say the US is the biggest risk for anyone operating in a non-US country except for their own government, so .com is a "safe" backup choice as well.
If you're really worried, the only safe choice is .onion :) Safe from having large numbers of users, too! (you'd be better off at that point distributing some kind of client software, or running multiple pop-up frontends accessing a common API, and then making it easy to move the API around using client-side failover.)
The .nz namespace is pretty good, as it is independently administered from the government (http://dnc.org.nz). It's just very hard to see .nz being adopted by startups to create pithy URLs.