So how does cloudflare know to not trust your key? They know some secrets from the token manufacturers and test your response against them? If so, what if the

So how does cloudflare know to not trust your key? They know some secrets from the token manufacturers and test your response against them? If so, what if the secrets get out? Then all the keys in those batches are poisoned? Isn't this just some sort of side channel certificate authority?