Since this may be a legal gray area, they should host it on a Tor onion site.

oooo, that's a missed opportunity

I can't even read this blog post because Cloudflare's "security verification" fails over and over again. The internet sucks now.

You are not missing much (it is basically an advertisement), besides the somewhat intimidating mugshot of a German dude as the header image.

I would sincerely hope .gov addresses use SPF/DKIM/DMARC. That makes spoofing impossible. In Revolut's case, the sender's email system had been compromised.

And what about the rest of the world?