We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware.
We would like to use CloudFlare for DDoS protection and caching reverse proxy.
However, putting my tinfoil hat on, I'm wondering is there any way to avoid being potentially MitM'd by NSA or any other entity that FISA likes to support? If I have understood correctly, CloudFlare is able to generate certificates for any domain they want (they are a CA) and NSA or FISA should be able to get backdoor to reverse proxies run by CloudFlare because CloudFlare headquarters are in the USA. If I point our DNS entries to CloudFlare, that is a free pass to read and modify any traffic on our site.
(I guess the same applies to Akamai and any other reverse proxy CDN located in the USA.)