Last I checked that tool reordered all the headers (which destroys a lot of forensic value amongst other issues) and neither should such a tool be the only way to get (supposedly) good exports.

Both the IMAP bridge and web interface should provide original unmodified emails upon request.

Current email encryption schemes provide no forward security, it's nothing like Signal. Key management has to work totally different.

You're also wrong in the aspect that it would undermine something, you can absolutely export keys from Protonmail, you just can't use your own keys properly. You can't remove all the keys they have generated, you can't use your own client with your own keys, the bridge literally mucks it up. The defaults can be what they are, it's not mutually exclusive in any way.

In the end this restriction undermines the security and privacy for everyone that want to use secure hardware storage. Which is absolutely insane for a service that boasts about these things.