I believe that having one of the encrypted webmails be exposed as being built to serve as a honeypot is sufficient to cast doubt over the whole idea of encrypted webmail.

protonmail started just after the FBI forced Lavabit to hand over data relating to snowden. Maybe they had a change of heart and decided that encrypted mails should be allowed to continue to exist to serve as honeypots.

After brief reading the websites of protonmail, tutanota, startmail :

Protonmail and tutanota offer an open source client, allowing you to verify their promises of encryption. Start does not, so it is quite possible that your message appears in plain text on their side. Start also says it uses TLS for user to server which is similar to gmail

Proton and tuta state that they generate the keys on your client and then encrypt privat key using your password. So it would appear that they cannot read your encrypted message plain text.

However, apparently it is possible that the server could be made to send you a web client which is rigged to leak your password. Tuta also offers a desktop client which is supposedly not vulnerable to such an attack.

the only thing which can be verified as being end to end encrypted is the content messages written by Proton/Tuta users using the open source client. Any mails you receive from outside can potentially be read plain text, before they later encrypt it.

Tuta has been forced to implement systems to hold messages unencrypted by German law: https://old.reddit.com/r/privacy/comments/dwouqj/tutanota_cooperated_with_authorities_to_keep/

to actually have any privacy benefits, you’d have to convince everyone to join the same email provider, but if you could do that you could instead make them join matrix/ signal

Obviously they can still track who is sending messages to who and what time. Tuta also claims that your metadata is encrypted but that seems absurd IMO since their server can easily be made to keep these records.

In additio to that, they have physical possession of your encrypted message archive so at any time, they could attempt to crack it or make attempts to steal your password in order to decrypt it.

Germany is also in 14 eyes