[junto]

I presume that customer private keys need to be stored on Cloudflare servers to implement this. Has that just made Cloudflare servers a legitimate prime NSA target?

I.e. all your keys belong to us

[rdl]

We have a product, "keyless ssl", which is used by some customers to retain on premise custody of their asymmetric key material, actually.