> Google isn't obligated to include every web site in existence in their index.

No, but to have a competing product appear highly ranked at first, then drop off their search engine entirely and not return until there is a public outcry, screams of anti-competitive action on Google's part[1]. That said, I don't think a lawsuit would get very far either. I'm just saying the whole affair is fishy.

[1] Or, if you want to go tin-foil-hat with it, perhaps a certain government told Google it didn't want people to know about a secure email startup that resides in a country that is known for upholding privacy rights. I don't buy that one myself but I've seen it bandied about in the past in similar cases.

Seeing how Google have a near monopoly on Search, perhaps they should be required to... or at least be required not to remove search results of already-indexed legitimate websites.

How does one create such a list? How do you distinguish domains that have gone rogue (either ones that were legit then went bad. Or if the domain expired or was sold to a nefarious person)?

I believe in this case protonmail was hit by an algorithm based derank (not a manual action). What causes it is anyone's guess. But something series of events hurt their ranking. Its also important to note that PM was NOT delisted. They still were getting traffic from Google, they were just deranked.