&quot;Keyless SSL&quot; is a bit of a misnomer. CloudFlare still holds the keys to encrypt and decrypt the content it is distributing and therefore sees everything (they can inject into your traffic as well). Even if they don&#x27;t hold the private key, they can act in every way as if they did hold the private key.