We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware.
We would like to use CloudFlare for DDoS protection and caching reverse proxy.
However, putting my tinfoil hat on, I'm wondering is there any technical way to avoid being potentially MitM'd by NSA or any other entity that FISA likes to support? Let's assume that I can trust CloudFlare to not leak any secrets for extra money only. If I have understood correctly, CloudFlare is able to generate certificates for any domain they want (they are a CA) and NSA or FISA should be able to get backdoor to reverse proxies run by CloudFlare because CloudFlare headquarters are in the USA. If I point our DNS entries to CloudFlare, that is a free pass to read and modify any traffic on our site.
The problem with FISA is that its decisions are not public. If CloudFlare was forced to work against my will by any public court orders, I could just switch to another CDN. However, when CloudFlare is forced to do something by secret FISA court order, nobody is any wiser and I cannot switch.
(I guess the same applies to Akamai and any other reverse proxy CDN administered by any company with headquarters located in the USA.)