That can't be right. If they're hosting on a different DNS they have an absolute need to MITM ssl/tls traffic. Can't work otherwise.

So cloudflare sees your plaintext. Btw: tailscale does not (but ssl errors and warnings are unavoidable)