Right now Proton's spam/block/allow lists only kick in after you've manually added a sender. A brand-new, never-seen-before address lands straight in the inbox (or gets guessed at by the spam filter) with no chance for the user to weigh in first.

I'd like to request a screener: when an address emails you for the first time, instead of going to the inbox it's held in a single approval queue. You get one decision per new sender: Approve (moves that message and any others from them to the inbox, and allowlists the address going forward) or Deny (the message, and anything else they've sent, is discarded, no notification is sent back to them). Existing contacts and anyone you've already approved would skip the queue entirely and land in the inbox as normal.

This is essentially the model Basecamp's Hey email service uses with its "Screener" feature. New senders can't reach your inbox at all until you've explicitly let them in, and it's genuinely changed how a lot of people deal with cold outreach and inbox noise. It's a stronger, more privacy-respecting default than block-after-the-fact, since nothing from an unapproved sender ever gets read/processed by you until you choose to let it in, which feels like it'd fit well with Proton's overall privacy-first positioning. As a result, I am now torn between encryption and strong border defense.

This is a different ask from the existing "Block sender" idea (which is reactive in that you block after getting annoyed by a sender). This would be preventive: unknown senders wait for your go-ahead by default, rather than reaching your inbox automatically.