>> won't instantly cave if/when the feds come knocking

I have never used ProtonMail for business and only have a private account with them. I quite like them mainly because as you say they probably won't cave in when the feds come knocking. Since they aren't based in the US (nor the EU which is equally important). The DDoS was unfortunate as they are a very young company so a bit unfair to be tested like that. But I think it shows that they didn't cave in to the ransom - which I respect and support more than them "fixing it" by paying up.