Correct, an attacker could pass off a false web page masquerading as protonmail, which you would then enter your password into. Highly unlikely you would be targeted this way unless you were literally planning the next Boston bombing and this fact was known. The emails are encrypted and unable to be accessed by anyone without your password. ProtonMail can share metadata with NSA, but not actual email contents. You're right, they didn't specifically say "We love the Donald!!", but they are at present the only tech company I've seen take a stand against deplatforming, and not hearing any better recommendations.. I'll stick with Proton