HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer.

> I as a user should be allowed to decide my threat model

Asking you if you want to proceed is allowing you to decide your threat model.

> We have so much compliance theater around email, and we still have exactly the same threats and issues as existed twenty years ago.

...and yet we have largely eliminated entire classes of issue on the web with the shift to HTTPS, to the point where asking users to opt-in to HTTP traffic is actually a practical option, raising the default security posture with minimal downside.