Any of those, self-hosted. Even regular old self-hosted email, but pin your certificate if you're worried about a Western govt doing a MitM. They have their own root certs trusted by default