Yeah, they were able (and thus legally required) to hand over the user’s recovery email address, which is what got them caught. You don’t need to enter a recovery email address, and you can of course choose to use an equally-secure service for recovery.
One big technical issue to note is that Proton doesn’t use end-to-end encryption for email headers, which includes recipients and subject lines, among other things. So that’s potentially exposed to law enforcement as well. I believe Tuta does encrypt headers.
It says:
And it uses Android Translation Layer. Interesting. I’ll give it a shot on my desktop later.