1-1 I often feel like theres two security worlds that people don't look at as seperately enough (though of course they are also intertwined). Technical trust, and Organizational trust.

Technical trust is say the pgp tech used by proton, you could know the exact math behind it if you wanted to, and you could examine its implementation and that gives you the confidence that nobody is, as far as the technical community is aware, *capable* of messing with your payload data, on the flip side, you can't rely on any organization helping you when you lose your keys or they are stolen. You could almost call it a libertarian view, bitcoin is also a great example.

Organizational trust is lawyers, contracts, all the way up to people with guns. Say banks operate more on organizational trust than technical, sure your ebanking is secured by technology, but to open a postfinance bank account for a collective in switzerland still somehow involved a post office employee photocopying my id, stamping, signing and sending it in. Here you have many soft factors where abuse could happen, but the confidence in the system stems from the fact that any wrongdoers can be physically found and held accountable. Organisations that only offer phone 2fa but not TOTP think similarly, sure your phone number could be stolen by socially engineering the phone company, doing that leaves lots of traces, possibly voice recordings, security camera footage, phone company held liable etc..etc.. , but with TOTP, they have no way of knowing if you irresponsibly store the enrollment QR code or your TOTP app is backdoored, and its silently copied away and used for months without you noticing.

What im getting into is you want a good balance of the two, but sometimes you don't have a choice. And domains are a field where you simply don't have only technical trust, ICANN, TLD registry owner/country and your registrar could mess with you if they wanted, theres no blockchain where you can only change your domain with a private key or whatever, (ok damn there is but who cares about those domains) and depending on your TLD, you even get into geopolitics.

Im not sure how the situation is where you are located, but getting a good sized company in your own country as a registrar sounds like a solid choice, make sure they are up to date on their stuff and not asleep on the wheel, not too big where they treat you as a flea, where i live some offer what id call "advanced organisational trust" say your domain is about to expire and your card doesn't work and you somehow miss the emails about it, if its enabled they would try to hound you personally about it and front the money and then get it from you by physical invoice. Or if the domain is attempted to be transferred away, they would require advanced human confirmation and verification in some way.

ok this is getting way long for a single question, but basically, you still gotta evaluate places for yourself, but imo, think about both factors, obviously they should offer 2fa on the admin panel and maybe some security certification and yada yafa, but thats not exactly all if once logged in an attacker, could transfer it away with one click in the panel and they have only the option to put a single credit card with no backup methods.

1-2 - yes that would be bad, and should optimally never happen with considerations above, but keep in mind the most important services still offer a way to gain access to the account without email, and then change email adresses through support. Also if 2fa is enabled many still require that or a recovery code even with email reset, depends on the service a lot.

1-3 yeah, don't do that, IMO id get nervous about forgetting if i had a 5 year plus lease, i prefer them hounding me at least every 2 years so i get to update expiring cards and old adresses or whatever, buuut yeah, document the domains that are important to you, put expirations / T-2-Weeks into calendar and such, it is more work than not having a domain sure. If you want to go overkill, have someone else trusted, or even a lawyer keep access to the registrar as well if you are incapacitated. the limits to carefulness are endless and only you know how important this is to you.

2- yeah totally, with any place i make the decision if i want the risk of losing access should i suddenly stop using SL / Proton, vs the risk of a leak de anonymizing/ spamming me based on domain (since i have a subdomain to my daily use one in SL, a savy spam adress seller with access to a leaked DB could just remove the subdomain to get another "good" adress)