Hacker News Reader

Yeah, the free version is HTTPS only between client and CF.

I made my blog hosted on Github HTTPS with this, mainly so that I can experiment some features like Service Workers.

Source? Last time I used it you could encrypt both hops (although you obviously need to tell CF to ignore the cert mismatch for backend server).

Yes, I use free CF with both hops encrypted. There's no way for my visitors to know this though. IMO CF should require both hops be encrypted.

They are both encrypted but since you can't verify the "server" certificate it is vulnerable to MITM.