> "You are connecting to Cloudflare and all your information is being decrypted and handed over on the fly" - wait, really?

As far as I know yes, in order for them to provide their firewall service they need to be able to decrypt your traffic to filter on headers, cookies or response payload.

It also means you're probably paying double the TLS handshake performance costs because both Cloudflare and your origin server will very likely have its own set of SSL certs.