I don't have a whole lot of sympathy for Mr. Keys. But it is nice to see a writer explain how the sentencing guidelines work, instead of just stating the statutory maximum of 10 years and treating it like that's the likely sentence.
The writer doesn't mention though, that "acceptance of responsibility", which generally just amounts to pleading guilty, knocks 2 points off the offense level, and the prosecution can move to grant a third point, as part of the plea agreement. That would make this an offense level of 13, which is a sentence of 12-18 months. Also as part of the plea agreement, the prosecution may agree to ask for a sentence at the low end of the guidelines range.
So my guess is he'll get 12 months in a minimum security facility. That doesn't seem unreasonable to me for giving server access to a criminal group.