In ECH, we still only complete one handshake per session. If you've got the right key for the inner client hello, you'll complete a handshake with the certificate for the domain you're trying to visit. If not, you'll complete a handshake with a certificate for the domain in the outer hello and the server will send you the correct key so you can try again with a new session. The client gets to validate the right certificate.
Cloudflare at least offers mutual TLS from the edge to your origin, I've yet to persuade either of the other major CDN vendors I've worked with that they should offer that feature. They've also pioneered the rather nifty ability to terminate TLS on a node that doesn't actually have direct access to the certificate it's using, which I'd quite like for some other use-cases.
None of which is to say that you shouldn't have any concerns about Cloudflare, but on the other hand if you're that worried then at least the server operators using Cloudflare are giving you a heads-up that you maybe don't want to trust their judgement?
many years down the road this is now an actual (with the problem cases handled) feature!
I'm really disappointed with how the ECH spec panned out. It's almost like "make sure middleboxes and GFW can block this" was a hard requirement. They should've made the handshake look like a session resumption (i.e. pre-shared key), since those aren't required to send a server name.