Is there anything stopping the German government from seizing their domain and pointing the MX records at a government controlled mail server if Tutanota doesn’t comply?
As a side note: there has been complaints recently from the European Court of Justice that criticised that the German prosecutors are not independant enough for European standards. A reform is being discussed in German political circles, but nothing specific is to be expected before this years general election in September.
> its a local public prosecutor who orders such operations.
Unless Germany uses "public" in wierd way[0][1] the public prosecutor is part of the government. (It's debatable whether they count as part the national goverment, versus just the local/city/whereever government, but the emphasis on "German government" rather than "German government" suggests that's not what you meant.)
0: eg British "public schools", which IIUC are actually the subset of private schools that aren't limited to a specific profession/religion/other demographic
1: In which case maybe I'm just one of today's lucky 10'000[2] who gets to learn interesting facts about the German court system.
What is interesting about this is that the word "government" is usually translated into German as "Regierung", but the German term is more or less exclusively used for the leading part of a body politics (Merriam-Webster's definition 1). When refering to the combined whole of executive, legistlative and judicary we would typically use the word "der Staat" (the state) or would talk about the "Regierungssystem" ("system of government"), which is a bit inconsequently because the "Regierung" is only a part of the "Regierungssystem".
So I was reading the sentence of the OP more in the sense of the first definition, because this was closer to the literary translation into German, but can now see that the meaning of the word in English is less precise and therefore more context dependant.
Footnote 1 it is then; neat. I'm not sure what a more precise translation for that would be; "administration" (eg "the Bush administration") is the best I can come up with, but that's vague and ambiguous in other ways.
However, if the DNS server is located in Germany, they can force that instead.
Replacing the latter is particularly hard as DNSSEC operates a separate single trust anchor and is not as easy to circumvent silently as say x.509.
It is a strong case for using key pinning on all levels, from routing protocols through DNS all the way to email signatures.
Did you see anyone ban Turkey or China roots?
There is nothing anyone can do to decrypt the content, even if given access to mail servers.