Proton Mail

Emails sent to non-Proton users are not encrypted.

Since web apps are dynamic and code integrity is virtually impossible to verify, Proton can easily serve a malicious frontend to target users that steals their PGP private keys upon login, enabling the decryption of all their emails. Audits cannot prevent this dynamic attack because they only confirm past states.

The service has onion addresses for both login and registration, but attempts to create a new account via onion usually result in errors like "too many usernames tested recently". Registration over Tor via a clearnet address works fine, but requires linking another email address or phone number.

Creating a new account over Tor via a clearnet address requires a confirmation code from another email address or phone number. Popular temporary email services with static domains are usually rejected, but a few services with dynamic domains are often accepted, essentially allowing you to create a new Proton account over Tor without linking any other identities.

Every email service provider is a honeypot because it's an account based centralized service controlled by one officially registered compliant entity that either already fully leaked its database or will leak it soon due to coercion and hacks. You should never use emails for anything important. If you must use a centralized email service, then minimize your metadata leakage with Tor and encrypt messages with PGP.