[nightcracker]

That's just naive with the information we have today. Google thought this too, and the NSA happily used that to eavesdrop.

[nitrogen]

Eavesdropping on the connection between CF and S3 doesn't say too much about a public static website, though. If you're serving private data, use an S3 bucket directly instead of the S3 static website hosting HTTP server.