Everyone has their own threat models, so I don't want to make broad, sweeping recommendations here, but if you use Protonmail to talk to sources, you should read this story.
The way Protonmail handled this whole thing is quite bad. No transparency, dismissing the story as being "blown out of proportion."
