This article confuses me. What would it even mean for Fastmail to offer PGP? The whole point of PGP is that you don't (need) to trust the people who transmit the message. Relying on them to do the encryption for you defeats the entire purpose.
Which kinda begs the question about what Proton thinks they're doing by implementing PGP on behalf of their users...?
> If it’s running in the browser with code downloaded from our servers, then if we get compromised, we can serve up a version of the PGP code which leaks keys or plaintext.
is well-known but only applicable to the web app, the other clients are less susceptible to this. Even for the web app, we are proposing to solve this problem: https://github.com/twiss/source-code-transparency
And the article linked from their article (hilarious itself) pointed out that this basically comes down to State Actors (Mossad as the example) or Everyone Else. If it's Mossad then there's nothing anyone else can do to protect you (because they can do secret-squirrel things through special security courts and stuff like installing black boxes on undersea cable routers). If Everyone Else, then the normal run-of-the-mill transport encryption is probably good enough, just don't click on any herbal boner-pill adverts.
tldr; If you want to be protected, you have to do PGP at the local machine level yourself.
[0] Given that Fastmail are Aussies, and that our idiotic government have given the spooks full, secret, access to anything they want, then this is a very real prospect for anyone that five-eyes might be interested in.
This is oversimplification if not misleading. There are also Bad Guys (who aren't state actors), who usually can't reach for your data. But occasionally they can, when rare Planet Parades like Heartbleed or Meltdown make the news. And they are happy to use this one-in-a-lifetime chance to sell access to your data to everyone else.
There was a time, long, long ago, when mail from your email provider to your recipient's provider would often go through other providers in transit. Nowadays (and for the last 20 years) all of the intermediary mail-servers in the Received: headers belong to either the sender's provider or the recipient's provider. They're usually spam-filters, application gateways, secondary servers.
I guess the major exception is people who use gmail or Mailchimp as an outbound relay. But that's deliberate, and entirely under the sender's control.