I'm imagining a slightly weirder use case where the user is on a network which replaces TLS certificates with locally-issued ones (to allow snooping, but generally not tampering), so the connection needs another layer of encryption done in the application layer.

The user could load a locally saved (and audited) page in their browser which contains the JavaScript client that connects to the self-hosted version of this Cloudflare service. The client would require the user to enter a pre-shared secret which is used to encrypt and authenticate the data being sent back and forth with the server.

Check out browserless for something that's the same direction: https://www.browserless.io/