Sure, but Google or AWS looking at your specific certs and using them to decrypt your traffic or impersonate you is probably far less likely than someone MITMin

Sure, but Google or AWS looking at your specific certs and using them to decrypt your traffic or impersonate you is probably far less likely than someone MITMing Cloudflare's connection to your server or even worse finding a vulnerability in CF (see cloudbleed [1]). I really really dislike how Cloudflare has legitimized MITMing many sites while making it look 'secure'. It's basic security, never trust someone else with your keys. 1: https://en.m.wikipedia.org/wiki/Cloudbleed https://en.m.wikipedia.org/wiki/Cloudbleed