[icebraining]

Another post in this thread answered it: HN uses Cloudflare's DNS, and they create a cert even if you just use the DNS.

[detaro]

HN doesn't use Cloudflare DNS for news.ycombinator.com, but is actually served by Cloudflare.