I think it'd be crazy to make a service worse because of worry over potential hit pieces that might whine about a perfectly reasonable policy. It isn't as if Proton Mail hasn't been accused of those things before anyway (along with accusations of being a honeypot and not private enough).

It's better to have integrity and fight for your users than to cave just to avoid click bait articles by people with irrational views.

Most CERT requests are valid and good and should be obliged.. but there should be a manual check involved.

Especially when an appeal is filed. Especially when the content is obviously security reporting.

Both extremes are wrong - don't ignore CERTs and don't mindlessly oblige them. Find one of the many reasonable middlegrounds.

I suspect there's a few email providers where the marketing and reputation management teams are hurriedly adding "check the user and the user's affiliated social media reach before suspending this account, and before responding to any support requests from the user."

My new elevator pitch: We proactively research all of our customer's users and new signups to assign them a social media reach score. We then automate escalating external account action requests or user support calls for highly ranked users to senior staff and providing details and evidence of their social reach and industry affiliations. While we generate revenue from these customers, our primary revenue stream is the aggregated data we acquire while doing this, and selling access to that data to law enforcement, the insurance industry, and Nation State intelligence organisations across the globe.

Or even have checked how busy the account was.

Or check their received legal mail.

They currently do cooperate and they go get the odd bad press about this.

So doing what they actually claim to do would change nothing. Their current stance is just a cop out.