Well, at least for several threat models, &quot;your site to CF&quot; is at least slightly better than &quot;CF to clients&quot;. It&#x27;s not vulnerable to things like unsecured wi-fi sniffing. Then again, neither are self-signed certs and for some reason all browsers consider them even worse than no cert.<p>On the other hand, it doesn&#x27;t protect against government spying, but then again, I think some governments straight-up MitM HTTPS traffic anyway. For instance:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=10663843" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=10663843</a>