For their web client, the encryption is really only useful as long as you can guarantee that the JavaScript code has not been tampered with. Once a court orders

For their web client, the encryption is really only useful as long as you can guarantee that the JavaScript code has not been tampered with. Once a court orders them to hand over the private key of their TLS certificates (as has happened in the Lavabit case), it's game over for anyone able to man-in-the-middle the connection to Protonmail, or for anyone who's able to compromise their web server directly. It really isn't any better than Lavabit if exposed to that threat model.