Makes me wonder if the company protecting against the DDOS would have motivation to encourage or facilitate the DDOS efforts too, makes them the protection racket itself.

If DDOS is really the problem we want to solve then it would be awesome if one can do it without looking into the packet. SSL terminating at some centralized third party provider is way too much power.