My concern is more about scaling than raw page speed: of course going through a reverse proxy is going to be slower end-to-end than going directly to heroku. But taking the static asset load off of heroku without a Rube Goldberg CDN deployment is great, IMO: they just leverage standard HTTP caching headers and then those requests rarely if ever hit your dynos, like the old varnish functionality you got with bamboo stack on heroku. It's much more brain dead, which works for me.

I don't use or care much for all the dynamic optimization they offer (I turned it all off) and, with respect to the SSL cert, I don't really care about how it is issued (to a first approximation, no one looks at certs except the browser verifying the cert against the URL) but YMMV.

It does appear that wildcard certs have gotten very cheap now: http://www.namecheap.com/ssl-certificates/comodo.aspx so the cost savings isn't as great as I thought. (Thanks for pointing that out aioprisan.)

I've found that heroku performance thinking is a bit different than raw page speed thinking: my goal in life is to minimize the load on my dynos. I'd be willing to put up with a CDN that was slower serving static assets than heroku is, just to keep the load off the dynos, but I've found CloudFlare to be plenty fast.