I like Proton. I use Proton.
However, the problem with proton is that if you access your email via a web browser, there's nothing stopping protonmail (to my knowledge) from reading your email from within their webapp via JS. This type of attack could be targeted at the behest of authorities.
So, actually, Proton COULD read your email (IFF you use webmail).
The authorities can also read your self-hosted email if they had a warrant to search your house. Even if you enable FDE they can do a cold boot attack.
tl;dr they pull the decryption keys from your computer while it's still running, which of course it is because your mail server has to be up 24/7.
How would one access it if one needed to do config changes or, really, anything the server for legitimate purposes?
Mail transfer can tolerate multi-hour interruptions. Imagine the drama if it couldn't!
I'd count that up as a hypothetical win of the self-hosted main in your own location.
If you are Dr. Evil, OTOH, other calculi apply.
They can just send things without e2ee from any of their clients (not just web).
> This type of attack could be targeted at the behest of authorities.
No? How can authorities tell them how to do their business?