• i think stripping +stuff from all providers is safe

Probably safe to enable it by default, but I think the same config file should reserve a place for listing domains that are exceptions, mostly out of principle. (Or even for listing domains and their separator characters, like { placewheregrawityworks.com = ":", someqmailsite.net = "-", weird.tld = null /* don't strip anything */ }.)

Make sure the code doesn't give weird results when the separator is the 1st character (like +fred@example.com). Gmail wouldn't have allowed that, but you know there will be some smartass running their own Postfix where it's completely legal. As is +@example.com, apparently.

handling +subaddress by default, paired with LISTOWNMAIL returning canonicalised matches, presents a problem when we hit a provider that doesn't handle +subaddress specially and there's two distinct humans with accounts that match the lefthand-side of the +. this seems like a bit of a show-stopped for "by default", as far as user privacy is concerned.

perhaps extending +subaddress stripping for canonicalisation should be paired with changing LISTOWNMAIL back to not considering addresses that only match once canonicalised