This is what I do. The USB-C one's work on Android just fine but it's a little less intuitive; the YubiAuth app still complains if NFC is disabled and you might have to turn on OTG for the key to be recognised (which auto turns off on some phones after 10 mins).

You could try Protonmail. It's secure and supports GPG out of the box.

They have a free tier that they run as a "charity case". As with anything where your data _isn't_ the price, they have paid tiers too.

I realize that doesn't answer your question about 365, but I meant to simply let you know there are good privacy friendly paid services too :)