My favourite CF conspiracy theory is that by terminating booters' SSL they know who will be DDoS'd, and when.