Cloudflare offers at least two options that don’t require them to proxy TLS: Spectrum and Magic Transit.