I'm either reading this wrong or there's a disconnect in knowledge. If you have your own SSL cert and do the termination of that on your end, CF cannot do any MITM without an error on the user's end.

However, if your just setting up an a record or whatever to your server that isn't doing ssl termination, then yes they are mitm