There is also the practical concern for NSA that cloudflare is a well resourced, highly motivated company who has publicly committed to protecting customer data. It would be a lot easier to push around a small company or non profit, especially a company which didn't have the resources or freedom to defend itself. It would certainly be possible to try to get a company like CloudFlare, Twitter, etc to bend to the NSA's will , but they know they are basically guaranteed a fight. Much safer to go to a smaller hosting provider or the end user organization or personnel themselves.