Hacker News Reader

Especially when cloudflare is governed by the laws of the US which includes the patriot act. How do we know this isn't already the case?

If your threat model includes intelligence agencies, set up your own HTTPS with HSTS and HPKP and don't use CloudFlare.

Wow, that was easy.

So, basically anyone providing online services to customers then? Who's threat model should not include intelligence agencies? Online pet shop?

It comes down to personal opinion more than anything.