The process makes file to read via http (not https), it’s just a nonce ( some random characters). Once their server reads that file, using the domain (and not the ip) and compares with what is expected, this shows you own the domain , and they give you a new ssl cert, modifying your server’s https configuration file (usually). And deletes the file it made .
Honestly, I know this is entirely subjective, but I never liked the vibes from proton especially in the last year. I’m going to use my animal instincts and just avoid them.
That said, I really need new email service so looking at options