If Proton chooses the local path, it must weigh functionality against device compatibility; if it chooses a trusted cloud environment, it must prove to users that it cannot peek.