So what's stopping these people that claim to be so righteous by using canaries from lying to you? Anyhow the ISPs and internet backbones are all tapped as many whistle-blowers have already revealed.
Nothing stops anyone from lying to you. In this case it would be considered fraud if the lie was discovered or leaked. Which is one of the rationales on why courts cannot compel a company to lie and post false warrant canaries, because it would incriminate them.
Fraud against paying customers, if they can demonstrate they wouldn't have paid if the company didn't lie. Also competitors if they can demonstrate they lost business due to the lie.
The SEC could throw me in jail. And, sure, you could believe that the FBI or whoever could tell the SEC what to do. We have European and Asian investors too, so their financial regulators could also sue me personally for lying. Perhaps the FBI/CIA/NSA control them too? Gets tricky to believe: the bigger the conspiracy the faster it falls apart. It's really, really hard to be part of some grand conspiracy as a public company.
The concern isn't a grand conspiracy, it's that you've been coerced to comply with the kind of surveillance overreach that US intelligence and enforcement agencies have repeatedly engaged in.
Cloudflare isn't the bad guy in this scenario, it's the hostage.