[meowface]

They allow "SSL termination" where traffic to/from Cloudflare's Edge is protected with TLS, as well as full TLS, where you also provide your own certificate and the entire chain is protected.e.

So, you can very easily opt out of the "MITM" if you buy your own certificate. You can use a self-signed one to get a little more safety within Cloudflare's network, or a CA-signed one for a lot more safety.