[kevincox]

But this doesn't work because the backend certificate is invalid (it covers *.github.io rather then example.com).

[homero]

But you'd give cf that cname I think

[kevincox]

Last time I tested this cloudflare validated using the domain name, not the cname.