This is for Cloudflare customers. Before this you went across normal Tor and hit an exit node and then went across the Internet to connection the nearest Cloudflare PoP. After this you go to the onion being run by Cloudflare eliminating the exit node and the hop across the Internet.
If you already have an onion for your service then you are already not using Cloudflare.
> If you already have an onion for your service then you are already not using Cloudflare.
To clarify my point, what I mean is I might have "kodablahforum.com" running behind Cloudflare but I might, as a convenience for my users, offer my service behind an onion service unrelated to Cloudflare. I am saying, if the service offers that option, it can be seen as a bit more secure (if you don't mind the unwieldiness of the onion service address) to access that instead of the regular domain that hits Cloudflare via an exit and then routes all traffic through Cloudflare onion services.
Again, in general, I agree this is a complete improvement for non-onion-service using Tor browser users of Cloudflare customer sites. And I think it's a good pattern for sites/hosts/CDNs to follow (i.e. onions as HTTP alt services) in the current absence of acceptably secure/decentralized DNS for onion services. But direct onion service access hosted by the endpoint is always preferred over a middleman if it is an option.
Also, since OnionBalance doesn't support v3 services yet, what is Cloudflare using behind those onion services to make them HA? Or are they each running on single machines acting as gateways that load balance after that?
Also, count me as one of those people that don't see much value DV certs have for onion services. A v3 onion is itself proof you have the ed25519 private key, so DV adds little on an identity and encryption front. EV has extra identity verification of course. I've read the EFF mailing list post in justification, and I'd say if features of TLS are a requirement (e.g. benefits of HTTPS), you might as well allow self-signed certs instead of having people use a CA. Granted, it's fairly harmless to allow DV for onion services, I just don't want to see it become the norm for HTTP-based onion services via promotion of the concept.
Shameless plug, here's a toolkit to create your own onion services easily in just a few lines: https://github.com/cretz/bine (including non-anonymous mode like the CF onion services). You can fire one up for your own site and give it as an HTTP alt svc.