Until homeomorphic encryption becomes a thing, cloud can’t be secure or private.
every exchange I’ve looked at holds the keys to your account
Exchanges, are not wallets. You’re supposed to move the coins out of the exchange for safekeeping. If you can’t, then it’s not a crypto exchange, it’s an ETF peddler.
how a user can actually buy bitcoin using Proton Wallet.
Wallets, are not exchanges. They can link to exchanges, like Metamask does, but their core function is to hold your keys.