I assume this is meant for countries where ISPs/governments MITM traffic and force you to trust their CA. It’s possible the Cloudflare verification is HSTS-pinn

I assume this is meant for countries where ISPs/governments MITM traffic and force you to trust their CA. It’s possible the Cloudflare verification is HSTS-pinned, or perhaps it’s distrusting of TLS PKI and signs the hash in some way. (Or it’s just built that way because governments are more likely to MITM Meta services than CF at scale)