Cloudflare requires the site operators to give up the encryption keys to (I believe it is) the https encryption certificate. I am not sure if this is exactly correct, however I know it has something to do with something that a user can look at to validate that they are accessing the website they intend to visit.