Yup, I have never seen a straight answer to this concern. One one hand, it seriously undermines the meaning of the browser padlock. On the other hand, this ha

Yup, I have never seen a straight answer to this concern. One one hand, it seriously undermines the meaning of the browser padlock. On the other hand, this has already been happening in less visible ways - Cloudflare is definitely not the first to do this. Plenty of sites and services terminate SSL early (and plenty of public CDNs offer edge SSL). The idea of end-to-end transport security via TLS is a bit flimsy to begin with tbh. What I find disappointing is that it encourages the "checklist security" approach. Management/dev/ops sees that this is the simplest way to get the padlock to show up, and the story ends there.