Your "understanding" is completely wrong.

CloudFlare's network in China does not contain configuration, settings, SSL certificates etc. from non-China CloudFlare customers. We run separate infrastructure there and only if you go through the hoops to expose your web site on our network inside China do we send information about your web site there.

Source: me (I'm CloudFlare's CTO)

Do you make it clear in the UI that a private key is ending up on Baidu's servers operated by Baidu's people? I don't use CF so I don't know - I'm just curious what the user experience is like. I'm asking because your CEO addressed concerns in the CNBC article about Baidu having access to your intellectual property so they seem to have full access.

I think the issue of user education is a real problem. I'm Wordfence's CEO - we're the biggest security vendor in the WordPress space. (We occasionally work with your support staff to solve a customer issue) and I know that user education in infosec isn't what it should be. We're actively working to try and fix that with a vendor neutral learning center we created.

So for example I'm not sure users understand the impact of having a partially secure connection to the endpoint when you only have SSL to a Cloudflare edge server and are reverse proxying in the clear. Same issue here - I'd like to learn more about the UX and how the location of their private keys is explained to them.

I think as vendors we're often to blame because the marketing team gets a little too excited at the cost of user education and clarity.

Re your comments on user education: if you'd like to learn more about our current UI, I encourage you to sign up for a free account at https://www.cloudflare.com/a/sign-up.

And if you encounter any experiences you feel are not sufficiently clear, I hope that you'll submit specific suggestions to me here: [email protected].

[quote]For the moment the China network does not support HTTPS traffic (HTTP only). Support for SSL/TLS will be made available in the coming months.[/quote]

As long as you don't sign in to China servers, they won't put you there. Even if you want to, first you need valid ICP certificate issued by Chinese govt.