Regardless of whether or not you provide your own SSL certificates, cloudflare still uses their own between their servers and client browsers. So any SSL encrypted traffic is unencrypted at their end before being re-encrypted with your certificate. How can such an entity be trusted?
For me the issue is that, as an entity in middle of communications between a browser and a web-server, (which should be transmitted end-to-end encrypted over https), they get to have access to the unencrypted traffic en-route, undoing the protection that HTTPS was created for in the first place.