Are you aware of a workaround? Otherwise, I agree with the ease now that LE supports DNS verification. I just wish we could edit existing domains in Gitlab.
I understand that's not technically "your problem", but since you mentioned it, just thought I'd let you know :)
It's unfortunate, because tumblr really is a great blog hosting software and service, if you don't use the social aspects of it.
But these aren't technical limitations! I don't know why Tumblr retricts you from using cloudflare, presumably because they want to control your content.
My two cents, don't use a free hosting service. S3+cloudfront is dirt cheap and will do the trick.
I'd rather deal with the very occasional “why not secure?” e-mail rather than pretend my site is actually secure. (I only serve static pages, not forms.)
And regardless of that it offers privacy for your users.
Beyond privacy it also vastly improve security too, since users are most likely to have malware and ads injected by an infected wifi router.
It also increases complexity of an attacker that has control of the local machine, since they'll now have to install a custom root certificate.
Nothing is perfectly safe, all we can do is raise the bar.
There are legacy setups like S3 with custom domains, probably github pages with custom domain. But in both cases there is no reason not to be using cloudfront or cloudflare.