This is pretty important for a network service which is inherently inline for all your traffic. It isn't so important for something like a video cache (which I don't think CloudFlare even supports), but for DDoS protection and services like that, I don't think I'd want to use a non-PCI certified service even if I weren't required to.