That’s a good point. One of the two biggest weak points of a so-called e2e provider/platform is, the e2e provider itself.
The only true e2e is e.g. Alice does gpg -ea on an offline computer, copy-pastes ascii and sends it to Bob via an online computer, who copy-pastes this ascii to his offline computer and does gpg -d there. Their seckeys are airgapped from the communication channel. Sharing your sec with a provider is especially ridiculous (e.g. Proton). At least that’s what I think.
Actually, Proton + your local key = don’t work very good. Usually you’ll have to use a key pair generated by Proton—sharing your sec with the provider is not good.
Nevertheless, Proton is 100 times better than Google to be sure. Those who are trying to ditch Google, Proton and Tuta are two good options to consider, also recommended by PrivacyGuides. For those who had ditched Big Tech and now starting to wonder if Proton is okay… that’s a bit tricky, still I say Proton is nod bad. I had recommended Proton to my friends until the French activist incident, followed by a few more bad incidents. Yet it’s understandable that Proton must obey it if they get a valid court order… If you’re a normal, daily user, Proton is good enough (if not the best), albeit a bit overpriced.