they also provide certs for mTLS between cloudflare and your origin, which you can layer in along with IP restrictions

(the term they use is “authenticated origin pull”)