User<>CloudFlare and CloudFlare<>Origin use separate SSL connections, so not quite end-to-end (CloudFlare sees the traffic unencrypted)

Yes it can, but not in the context of the post I commented on.