You don't because that's how HTTPS is built: the client trusts whatever is sent its way as long as it's sent with a certificate that matches the domain. Said d

You don't because that's how HTTPS is built: the client trusts whatever is sent its way as long as it's sent with a certificate that matches the domain. Said differently, the server trusts Cloudflare to distribute the content as expected, under its own name. This is _technically_ no different than you trusting a machine to run the correct code and return the correct page, whether it's at home or at your hosting provider. You as a website owner have to trust all those components to behave correctly, and Cloudflare is just another piece of it. Of course given the easiness with which Cloudflare can intercept the data (versus your hosting provider running some other code), the threat becomes palpable, but HTTPS can't give you anything here.