Ultimately, if you're running in a virtualized cloud environment, you already trust your hosting company with your website's certificates (because there's no way to stop them from spying on your machine's core memory). So for most users, it's not a major change to expand the trusted set from {Amazon} to {Cloudflare, Amazon}. If you're the only one with root access to your hardware, then more power to you. But for most people I don't think it's a major change of threat model.