Regardless of whether or not you provide your own SSL certificates, cloudflare still uses their own between their servers and client browsers. So any SSL encrypted traffic is unencrypted at their end before being re-encrypted with your certificate. How can such an entity be trusted?
I am concerned about them being a technical SPOF for much of the internet, and there is the possibility that some hitherto unknown long-term persistent data gathering infiltration is able to sweep up a massive amount of information. And maybe they will turn malicious? Who can say? There’s plenty of precedent. How long between when it happens and when we find out?