He offloads TLS to the Proxmox server within their home network. TLS is used between that server and Cloudflare to keep everything safe during transport.

Recent OpenBSD should be able to do modern TLS, and probably ACME, which would have been more interesting.