[tialaramex]

Sure, you can just go buy a certificate for an IP address. The Subject Alternative Name extension used to make X.509 certificates work on the Internet this century takes IP addresses (IPv4 or IPv6) just as happily as DNS names (including IDNs, written with A-labels) or email addresses. You will need to prove enduring control over the IP address, often by showing that one of the RIRs issued it to you as part of a block assignment.

Of course running an RIR isn't free, and so the RIRs charge fees to their members, Cloudflare will be paying APNIC (and probably all the other RIRs since they're a global company).

And we're straight back to the usual suspects insisting that surely they ought to be entitled to everything for free. How can it possibly cost money to blah blah blah. Basically all you need to watch out for with such people is to make sure you get paid up front, because given an opportunity to stiff you they won't even feel guilty.