Proton Mail’s web interface can be made to present a forged sender identity that is visually indistinguishable from a legitimate one.