[devinsit]

Oh I'm well aware of the disconnect. I just disagree that there are only people who care about privacy to the degree that they have to self-host everything. I believe there's room to ride the line between being 'privacy-first' (in that we care about privacy, first and foremost) and offering convenience (i.e. providing a web app).

I'm sure my customers who signed up with ProtonMail and Fastmail addresses can attest to that fact.

And for those who do fall all the way to the self-hosting side, well, there's plenty of other options on the market! Of course, there's nothing stopping us from being one of those options, it's just not our priority at this very moment.

[fragileone]

Thing is anyone even passingly interested in privacy will start questioning it - is it open-source? Can it be self-hosted? Is it available as a desktop app? It's privacy theatre unless the privacy can be proven.

[mathrando]

Why not team up with the ProtonMail people to build a browser extension that verifies and logs javascript sigs/hashes? Corporate clients may like it. Gives them an IOC for the next big supply chain issue.

I don't know enough about browsers or js to know if its difficult or not.