It's legit. I also recommend using obtainium app from fdroid, which can download apks from github, and other sources. It also checks if there are updates for installed apps.
It has pros and cons. You fully trust the developer and also Github. For a reasonable experience you need a Github account and Token to avoid a fast rate limit.
Also, F-Droid is a really simple application, which doesnt support a lot of things, reducing attack surface a lot.
I use Obtainium and get most apps from releases, some from F-Droid. I would say, if it isnt known, prefer F-Droid.
You can, but you won't get updates that way. Some of their apps are available as GitHub releases, which you can add to Obtainium. You can also add the direct apk download links to Obtainium, but update checking isn't great using that method in my experience.
You'd be surprised to find out that ProtonMail uses Google's push service (unless you have GMS disabled) so your emails aren't hidden from Google as much as you think.
your emails aren't hidden from Google as much as you think.
You're wrong, Proton encrypts notifications before sending them to you through Google or Apple push services. The notification is then decrypted in the Proton client on your phone, and only then displayed to you.
Just a heads up, if you have a modern smart phone, Fdroid Basic is the latest and greatest official F-Droid app. The non-basic one is for older devices, now. It has to do with internally being able to use Android's newest targetsdk version.
From what I understand, that is not totally true. Basic does target the newer Android versions, but from what I understand, they are bringing the main client up to date as well. I'm using the main client at the moment, and it used to target 25, and now it's targeting 29. It's obviously still not the newest, but it has increased quite a bit, and I think it will continue to do so.