I understand part of your concern. And it would be interesting to hear your opinion. For example, the site may have a certificate issued by an outside organization, but it will still use cloudflare services, you will never know, but you will be sure of your safety.
That doesn't matter: the certificate handles the traffic between the user and Cloudflare, not between Cloudflare and the server. See this post (about Bitcointalk, but it applies to any site that uses Cloudflare):
What I meant is that Cloudflare can see your unencrypted password when you log in. It's still encrypted from the real server to Cloudflare and from Cloudflare to you. So it's not blatantly insecure except in that Cloudflare is very probably an NSA honeypot, and it's not like the NSA is going to steal your password in order to scam people on bitcointalk.org or anything. If you use PGP for important communications and use a unique password, then IMO this addresses the plausible attacks well enough.