[twiss]

Proton does not have the private key material. When you sign up to Proton Mail, the client generates a key pair for you, encrypts the private key with your password, and sends it to the server, along with the public key (which we publish).

Then, when you log in, the client fetches the encrypted private key, decrypts it with your password, and decrypts your emails with the private key. All of this is done automatically but it's still end-to-end encrypted.

The first citation (WKD draft specification) simply describes how to publish (and look up) public keys for a given email address on its domain. So for [e-mail] (hypothetical example), the key is published at https://openpgpkey.proton.me/.well-known/openpgpkey/proton.m....