Self hosting puts you in control, which means you have potentially more safety so long as you manage risk. Physical custody of your data is very valuable. The metadata thing is more of a theoretical risk.
Embrace the fact that email is not ephemeral and can end up in the wrong hands from your perspective. The other party that you're communicating with is a far more likely leak than some rogue ISP or police action.
More to the point: Google is a more central actor, who gets to see the data of far more users, than your ISP ever will.
Moreover, this moves from giving a third party your data, to giving them your metadata, and while people consistently underestimate the value of metadata, there is still an incremental improvement there.
So I ask: is there a way to provide an optional TOR endpoint? e.g. can I have an MX record with high priority that points to a .onion address, and then have a backup (with lower priority) that points to the normal global IP?
Postfix, for instance, has [transport maps](http://www.postfix.org/transport.5.html), but those let you pick a transport based on the email domain, not the MX host.
Right now, some people use [onionmx](https://github.com/ehloonion/onionmx), which maintains both a [static mapping](https://github.com/ehloonion/onionmx/blob/master/sources/map...) from domains to onion services, and a dynamic one using [SRV records](https://github.com/ehloonion/onionmx/blob/master/SRV.md).
I think the difficult part is getting outbound MTAs to actually understand that a .onion domain shouldn't be looked up over DNS.
If you're running a local tor-compatible resolver they should be!
However according to RFC 7686 https://tools.ietf.org/html/rfc7686: "Applications that do not implement the Tor protocol SHOULD generate an error upon the use of .onion and SHOULD NOT perform a DNS lookup"
Also, if ISPs are "tapped", you have a problem at the government level. IMO, privacy issues and government intrusion are not something technology can beat. Forget home servers and decentralization and usb sticks - If it's in your head, any determined government will waterboard that information out of you.
However, I tend to think of governmental privacy threats as the most important ones, and I assume that many other people in this discussion (and in the community of people who strongly advocate decentralization) share that perspective. Your prioritization is sensible if you're much more concerned with corporate monitoring (especially if you live in a jurisdiction with effective data protection legislation).
You might also want to consider people who live under extremely violent or repressive governments, whose concern with government as a threat actor may be easier to sympathize with. They're probably better off in the short term with something like Google because Google will likely resist data requests from their governments, while the ISPs (being local and sometimes state-owned) will likely not resist those requests. While they can't resist every surveillance or coercion scenario, it's easy to imagine that they can fly under the radar easily by using Gmail if it's popular where they live and they aren't doing other things online that the government finds interesting.
(This isn't purely a rhetorical question; maybe the balloon can be more tamper-evident than an undersea cable would be, or maybe the model for where link-layer or network-layer encryption can be applied could be more transparent or more controlled by a user or customer. But overall, it's tricky to explain why using RF, which there are tons of spy facilities worldwide and even in space to intercept, is safer than using an undersea cable.)
With self-hosting and SMTP, there is now a very clear TCP metadata record showing how my home IP address connected on port 25 to your home IP address. Maybe the next day you write back, and there's another nice clear metadata record showing your address connecting to me. Now any ISP between us, and anyone who can tap the ISPs' cables, knows that you and I are corresponding.
If we were both using Gmail, this metadata pattern would pretty much not appear at all: we would each make an HTTPS connection to Gmail and exchange a bunch of data, and while in principle my upload would be matched in size by your download, it would be extraordinarily noisy in many ways and hard to correlate in practice. On the other hand, Gmail would know everything about us.
Having Gmail know everything about us is clearly terrible and not a good privacy solution. However, having all of the ISPs be able to learn our detailed correspondence patterns and relationships is also clearly terrible and not a good privacy solution. So, self-hosting being a clear privacy win for messaging will require a lot of technical improvements on the metadata front. It isn't a clear win in this respect today; it most likely depends on whether you see ISPs (and people who can compromise or coerce them) or Google (and people who can compromise or coerce them) as a bigger risk overall.