an obvious next move for cloudfare is to spoof your website
Technically, that's possible. But how likely is this?
I know Cloudflare can change the site's content, but I'm genuinely curious - does anyone know of an instance of them doing such a thing?
I've never read about such a case. That doesn't mean it's not possible, but it makes me think it's not very likely either.