Ask HN: How to protect users from Cloudflare and server from users?

I'm building a privacy centric React app that does all the work client side, using a server only for the static files required for the app to run.

I don't want to expose users to Cloudflare or similarly gag-order / mitm prone services that could theoretically intercept and alter client code that reaches users' browsers. At the same time, I don't want to expose the servers hosting the static files to the world. What are some options to achieve both goals?