Politics aside, the OpenPGPjs library would be a viable alternative with a client side checksum program, but sure enough, the builds are reproducible.

Until then, this isn’t even technically true.

For example, you can’t import your emails with the POP3 so when your mailbox gets full you can’t even pay for one month and download them all while deleting them from the server.

It isn’t usable for free accounts and there was pre-4.0 a cult-like trend on the support subreddit to disclose your tier. I’m not aware of any moderation post, or note, asking users to stop this practice (u/ProtonMail was listed as a mod account).