If a topic is sensitive enough I might use email to ping someone and tell them a word that means get on my private server. I have taught a handful of lawyers how to PGP encrypt using Thunderbird, so simple a child could do it. It does leak some meta-data but that is sufficient to say "get on my private or semi-private server" or to have lawyers SFTP files to me. I tell them the passphrase over the phone. It also helps to have many aliases
canaries on many domains to break some aspects of tracking. There is no single solution to privacy. It takes some facets of OpSec and embracing some friction. I am happy many people hate the friction as it moves them lower on the totem pole.
I might some day regret teaching lawyers how to PGP encrypt files and messages.