Turns out Cloudflare deems 5 seconds latency too much. I thought most default timeouts were something like 30 seconds, and when writing applications myself I usually limit them to 8 or 10 seconds (to be able to get back to the user quick enough with an "unable to connect" error, but to also give it a moment). I expected that 5 seconds latency would be slow, but not unbearable. Instead it breaks stuff completely.

From my testing, 3.5 seconds latency works fine. Slow, but it consistently works.

Adding 5 seconds latency just breaks TLS connections to Cloudflare, though DNS, TCP and HTTP work. I was able to retrieve a webpage (via netcat) from my site, the redirect to HTTPS from http://news.ycombinator.com worked, and pinging showed a consistent 5030ms +/- 10ms latency.

Adding 3.5 to 5 seconds latency (random variance) makes, as expected, some connections fail. On my second try, I was able to load the Hacker News homepage, consisting of: 1) the homepage; 2) robots.txt (wget retrieves this); 3) css file; 4) javascript file; 5) favicon; 6-10) 4 images. In total 10 resources, taking a minute and 20 seconds. After establishing a TLS connection, it could reuse that connection for multiple requests. I think this is equivalent to hitting reload a few times in a browser.

So VPN-TOR-VPN might work still, though it is indeed more on the edge than I expected. Thanks for making me venture here, I learned something!