I first encountered Proton because they were claiming to be a 'secure' email service but didn't really list a threat model and... they're email. There's basically no way of making email secure against a realistic modern threat model. You can do S/MIME or PGP and get end-to-end encryption, but they're so painful to use that the odds are that (unless all of your friends are masochist crypto nerds), no one you correspond with will be using either. I couldn't even get my solicitor to use S/MIME for signing emails to give some integrity guarantees, let alone confidentiality. And, if you do this, email still puts all of the headers in plain text so the provider can see them and has access to the entire shape of the connection graph. So they felt like snake oil and I largely ignored them.
The next time I heard about them was when they funded a far-right YouTuber and endorsed Trump. So they seemed like people who probably weren't to be trusted with any data.
And now they're apparently all in on AI and firing people who say things like 'maybe we should do thirty seconds of security review before we push the output of the bullshit generator to production?'
My surprise level is sitting at approximately 0%.
