That's not even the worst of it. Websites that use reverse proxies such as Cloudflare to give them the HTTPS for the first leg (visitor->Cloudflare) give no ind

That's not even the worst of it. Websites that use reverse proxies such as Cloudflare to give them the HTTPS for the first leg (visitor->Cloudflare) give no indication that the second leg (Cloudflare->origin) may be totally in the clear. The UX is going to be tricky to get right.