They claim this is not possible under Swiss law, fwiw. We’ve recently seen that it is possible under German law, with a competitor (Tutanota) building a server-side backdoor for one user.
How is that any different from them being compelled to disable or weaken clientside encryption?
In both cases they're being compelled to make changes to their service.
The camel's nose is clearly already under the tent. Everybody needs to start diffing javascript served by them.
The GP says that it's possible under German law. Is it "FUD" to say that it could end up being possible under Swiss law?
Shouldn't there be fear, uncertainty, and doubt about any channel that activists use to communicate with each other?
It would be nice if there were something like Perspectives[0] or Binary Transparency / Sigstore[1] to raise the alarm when something like this happened, but the threat would also be avoided if ProtonMail was available as a SecureBookmark[2].
[0] https://www.techrepublic.com/blog/data-center/ssl-tls-certif...
[1] https://security.googleblog.com/2021/03/introducing-sigstore...