There's also: - If you discontinue using CloudFlare, you don't need to generate a new key-pair, and all of the issues associated with the infrastructure for re

There's also: - If you discontinue using CloudFlare, you don't need to generate a new key-pair, and all of the issues associated with the infrastructure for revoking the current key-pair. - There is also this: https://news.ycombinator.com/item?id=8336041 https://news.ycombinator.com/item?id=8336041 , which mentions protection against key-recovery due to Heartbleed-type bugs, which is true. If the SSL-stack is attacked, the attacker only has the same access that CloudFlare does. They can't recover the keys from the key server.