1. hlandau puts it correctly. It decreases security. So you sneaky terms of service do not apply. As for #2, it looks like there's a good way to revoke cloudfl

1. hlandau puts it correctly. It decreases security. So you sneaky terms of service do not apply. As for #2, it looks like there's a good way to revoke cloudflare's automated wildcard certificate generators: "In addition, the CA SHALL establish a process that allows an Applicant to specify the individuals who may request Certificates. If an Applicant specifies, in writing, the individuals who may request a Certificate, then the CA SHALL NOT accept any certificate requests that are outside this specification. The CA SHALL provide an Applicant with a list of its authorized certificate requesters upon the Applicant's verified written request." That someone needs to write ALL CA's and explicit revoke authorization showcases how bad this is.