It takes very little effort to provide a cert these days. Even a landing page should have a cert. Especially from a company with a reputation for security and privacy like protonmail's.

So someone could phish it and pretend it's complete to get people's data...