> If that's the case you are putting your users at risk, by pretending there is a TLS connection to your server when really it's only to CloudFlare. The connection from CloudFlare to your server is completely unprotected and is routed over the public internet.
How much of a risk is this in practice, assuming that when I do illegal things I'm very careful to only use sites that I know are end-to-end encrypted, and so for sites going through CloudFlare I'm only worried about criminals snooping for identity theft or credit card theft or similar purposes? [1]
I'd guess that criminals are overwhelmingly more likely to manage to intercept things near the browser side of things than near the server side of things. Probably most likely would be by taking over a public facing wifi router. I'd expect that getting in between CloudFlare and the server would take resources beyond most non-government actors.
[1] Note: I am NOT making an "if you aren't doing anything illegal, you don't need to worry about government snooping" argument. However, there is plenty of information that I consider confidential in the sense that I do not want it generally known, but where the government already knows that information. So, if some site asked me for such information and I needed to decide if they are providing adequate security I would only need to consider non-government snoopers because government snoopers already have the information.