To be fair to cloudflare, this is what the website being protected pays them to do. They can't effectively block malicious actors that are 100x more sophisticated than me, without being able to analyze that data.

I understand the risk of "evil" they could pull off with such a huge portion if internet traffic flowing through them, but the "you pay us for this service" model means they don't _need_ to monetize in evil ways. Whether they end up doing that or not remains to be seen.

I'm 100% against AMP though. As noted elsewhere, Google has repeatedly demonstrated they're not to be trusted.