[gruez]

>And I doubt (seriously) AWS (Azure) has means to do MITM, reading private keys from virtual machines? cmon.

that's only if the website(s) are only using their IaaS offerings (which I doubt because they're crazy expensive compared to DO or vultr) and not their PaaS offerings. With PaaS (think heroku), they terminate the SSL and control the software for the http server, not you.

[sciurus]

Even the IaaS offerings have widely-used load balancing services that terminate SSL.

https://aws.amazon.com/elasticloadbalancing/

https://cloud.google.com/load-balancing/

https://azure.microsoft.com/en-us/services/application-gatew...