"With CloudFlare being in control of the DNS and having a wildcard certificate without the domain owner's knowledge would give CloudFlare the possibility to r

"With CloudFlare being in control of the DNS and having a wildcard certificate without the domain owner's knowledge would give CloudFlare the possibility to run a MITM on many, many domains without anybody noticing as the certificates are valid and issued by a trusted CA" This is how the system works when it comes to domain validated SSL certs. Anybody who controls the domain's DNS, can get a trusted SSL certificate for the domain from certificate vendor. As long as the DNS is controlled by third party, revoking the existing certs does not make a big difference, since if they want to do MITM, they can just get new certificates at any point.