Hacker News Reader

Source? Last time I used it you could encrypt both hops (although you obviously need to tell CF to ignore the cert mismatch for backend server).

Yes, I use free CF with both hops encrypted. There's no way for my visitors to know this though. IMO CF should require both hops be encrypted.

They are both encrypted but since you can't verify the "server" certificate it is vulnerable to MITM.