I will skip some parts because I think it’s not worth repeating.

I think the vast majority of Mutt users don’t get their Mutt binaries from Kevin McCarthy, and having him put a targeted backdoor in the source code would be foolish as it would be likely to be noticed by one of the mutt distributors who builds it before it gets distributed. Since reproducible builds still aren’t ubiquitous, the best place to insert a widely-distributed-but-targeted-in-code backdoor would be at the victim’s distributor’s buildserver.

This was clearly just an example. Any distributor is the single of point of failure. You can coerce or compromise it, and you will serve compromised software.

Yes, but unlike the ProtonMail case there is a chance of being caught so it is a much higher risk for the attacker.

No there isn’t. There is nothing that prevents Github to serve you a different file when you query the same URL than what regular users will (for example by IP). It’s trivial to do this with any reverse proxy. And the same applies for a signature file, which means you can only notice if you manage to get the file and the signature from someone else and compare the signature/hashes for the same release. Which is basically the same as saying “I will compare my JS blob de-minified with the one in the OSS repo”, nobody does this either, I agree. This can totally happen every time you download something from any website, technically, provided that the server is coerced or compromised.

on a spectrum of difficulty to attack

Not really. The spectrum is much narrower than how you present it. I bet 99% of users install software in one of these ways:

• Package manager (linux/Mac).
• Download an installer or the code from the software website (Windows, AppImage, etc.).
• Install through a platform (say, Steam)

Almost all the package managers AFAIK work under the same model (package, signed with the distributor’s key, served via web), which is susceptible to coercion and compromise. All the webservers and platforms can be coerced/compromised to serve different files (installers) to different clients.

Am I missing something? Is there another way to serve software that I am missing?

numerous single points of failure that can be exploited to attack a specific user

There is one, so far. The provider being compromised. The rest is your speculation such as

but it’s because you have not been hearing me saying that HTTPS has been circumvented numerous ways over the years and will continue to be

Which is like saying, there are vulnerabilities. Yes, there will be vulnerabilities, but this applies to any software too. And if HTTPs is broken to allow MiTM then this is a risk for any software you download via web, starting from the linux ISO, so it’s far from a webmail-specific problem.

No. See previous answers for the massive differences.

You list:

• These days, in many/most cases, at least two keys/people are required to compromise them. This isn’t nearly enough but it is better than one.

Nothing, absolutely nothing, tells you that it’s enough to compromise one Proton employee to gain access to production and replace the code. Also, you have absolutely no idea of the security practice of the couple of people who handle those keys, they are not accountable in any way, they don’t need to be compliant with any standard (for what is worth), etc. I would say it’s much more likely for any of the mirrors/repositories to get compromised compared to Proton.

In fact, you say:

From your earlier comments I think you’re working from a mental model where an individual employee performing the attack would need to check something in to git or something like that, but, don’t you think anyone with root on, say, one of the caching frontend webservers do this? I suggest that you try to think about how you would design their system to prevent a single person from unilaterally doing it, and then figure out how you can break your design.

I do this for a living. One way to do this is to close off production environments, assign temporary permissions that require multiple people to sign-in at the same time and spectate when production is accessed. Teleport allows to do this, for example, nothing I am conjuring out of thin air. Similarly, the CI can implement a million check to verify the provenance of the software and require multiple sign-off before things are actually deployed. Breakglass procedure exist (usually for a handful of individuals), but they generate alert and are audited post-factum, so that such attack would be detected.

• Other than by IP, users aren’t identifying themselves before downloading things

True, but for me being attacked this changes very little. Attackers can just establish a C2, check if the target is right and do not do anything else on other devices. I grant you, this is a difference, but the control here is the fact that more people will possibly spot the issue and I will get to know it before getting compromised. It’s possible, but it’s a very weak control.

Users can access them from many different mirrors; there isn’t a single server from which to target all users of a given distribution

True, bigger attack surface, but each individual mirror can be compromised via the same vector (and of course the source can). Also Proton does not have a machine that serves everyone. Might have multiple regions, multiple clusters, separate by accounts, departments etc. In addition, you are talking about a highly targeted attack. Relying on the obscurity of which mirror someone uses is really not something I would consider applicable here.

The biggest difference is the automation with which JS code is “updated”. This is what makes the attack potentially slower via regular supply chain. Nothing I would consider massive for sophisticated attackers like the ones able to exploit this vector. So the massive difference in your opinion is that:

• Attackers are not able to target individuals with the same precision.
• Attackers might need to know more about you to target the distributor of your software.

On the other hand:

• A company with a security department has a smaller chance to be compromised compared to random individual
• A company like Proton at least has to adhere to some standard and security hygiene, which individuals handling package repos/mirrors don’t.

If for you these are massive differences, OK. For me they are not.

Finally:

If both users are using the bridge (assuming it is designed how I think it is), they would certainly be better off than if one or both of them is using the webmail e2ee. However, I would never use or recommend using protonmail, even with the bridge, because it is very likely that the people I’m writing to would often not be using the bridge. Also, because ProtonMail e2ee doesn’t interoperate with anything else, and by using it I’d be endorsing it and encouraging others to use it (“it” being ProtonMail, which for most users is this webmail snakeoil).

How it is relevant what both users are using the bridge? The bridge is literally doing the same that -say- mutt does. This has nothing with the bridge, what you are saying (I think) is that you wouldn’t send an email to someone if you don’t trust the software they use, but this is independent from you using the bridge. You can add other people (non-Proton users) keys to be used, so Bridge -> Mutt is exactly the same as Bridge -> Bridge or Mutt -> Mutt.

because it is very likely that the people I’m writing to would often not be using the bridge

In this case there is no tool that you can use that will “protect” you, if you don’t trust the other side.

Also, because ProtonMail e2ee doesn’t interoperate with anything else, and by using it I’d be endorsing it and encouraging others to use it (“it” being ProtonMail, which for most users is this webmail snakeoil).

Which is not a security consideration.

The security model of the bridge is the same as the security model of mutt, or other CLI tools or anything you might use for PGP. It seems you have absolutely no security consideration why this would be worse.

So, in short:

• Using protonmail you address the security risk you highlighted in the same way as it is addressed by using any other client tool that doesn’t run in the browser.
• The fact that you won’t use it because of your personal crusade against webmail is irrelevant in terms of security for a non-webmail too.