Indeed, CloudFlare will happily run an HTTPS front-end proxy to an origin which is using a self-signed certificate, or even to a HTTP origin. Thought that site was secure? Think again!
If the origin used a self-signed cert, doesn't cloudflare use certificate pinning?