You don't need to trust Let's Encrypt anywhere near as much as you need to trust Cloudflare. With Let's Encrypt, I generate my own encryption keys and never sh

You don't need to trust Let's Encrypt anywhere near as much as you need to trust Cloudflare. With Let's Encrypt, I generate my own encryption keys and never show the private key to anyone. LE just signs the public key. The risk is that they might also sign someone else's public key as being valid for my domain. But my servers will reject any traffic that isn't encrypted with my real public key. The best an attacker could do is set up a phishing operation. But any CA can improperly sign a public key as being valid for my domain, not just LE. This is just a result of the CA system being broken by design. On the other hand, Cloudflare is usually only useful if you let them terminate TLS on your behalf. So you have to give them your private key, and they really do have access to all of your traffic. At this point, they can do whatever they want with it, largely undetectably (i.e. without the risk of releasing obviously fake certificates into the wild).