That makes using https instead of http a lot less relevant.
The only weak link now is Cloudflare, which is still "less secure than a direct connection" (with respect to government spying, bugs[0], hackers, etc) but the threat level is drastically reduced.
0: https://blog.ryankearney.com/2013/01/comcast-caught-intercep...
I'm guessing it's a sufficient condition, bit not a necessary one. I.e, a could be using Cloudflare's WAF with a SSL cert issued by somebody else.
0: https://developers.cloudflare.com/ssl/edge-certificates/adva...
https://news.ycombinator.com/cdn-cgi/trace
Every Cloudflare site will respond to this URI.
That said, the choice is yours whether or not to use sites that utilize such untrustworthy MITM providers, like Cloudflare. There are even browser plugins that can automatically block connections to such untrustworthy entities.
This isn't an endorsement, and you should always review the source code of any browser extensions you're utilizing due to the risks extensions themselves can pose, but I personally use one called Cloud Firewall and it works great. (https://addons.mozilla.org/en-US/firefox/addon/cloud-firewal...)
There aren't obvious signs up front that a site is using cloudflare. Failure to spend time investigating is not "freely choosing it".
You're joking, right?
It takes 2 seconds to click the padlock in your browser, click through once more, and see "Verified by: Cloudflare, Inc". You don't even need to view the certificate.
If 2 seconds and 2 clicks is too much time and effort, it's obviously not actually that important to the user in question.
https://developers.cloudflare.com/ssl/edge-certificates/cust...
It's not always that simple.