“Proton's founding principle is that storing data on a third-party service should not grant that service control over the data or imply trust that the service will not lose it.”