There is a security distinction, and this has been shown by for example cloudbleed. Every step that has access to plaintext data is a potential attack vector an

There is a security distinction, and this has been shown by for example cloudbleed. Every step that has access to plaintext data is a potential attack vector and might be logging/leaking information. There has also been times where cloudflare (when setup improperly as I mentioned in the previous comment) has misrepresented the security of a connection, as shown by https://www.theregister.co.uk/2016/07/14/cloudflare_investigating_mystery_interception_of_site_traffic_across_india/ https://www.theregister.co.uk/2016/07/14/cloudflare_investig...