Instinctively I agree with you, but I am having trouble convincing myself that this is fundamentally different from a CDN. In fact it seems better than a CDN - the relevant private key remains with the website authors, and is not held or controlled by the CDN. I don't get any warning in the browser that https://www.cnn.com is delivered by and signed by Fastly (unless I click to see the cert and see Fastly in the OU); what makes a webpackage of amp.cnn.com, signed by a key actually held by CNN's IT staff, worse?

(Also, if we think this is worth indicating, it should be done by the browser itself, not by the web page voluntarily including some CSS.)