Comment by bawolff

Yes, the person who controls the DNS controls the certificate.

What a certificate is supposed to verify is that traffic is going to the right place. If you designate cloudflare as the rightful host of your website then they can get a certificate.

This isn't an edge case though. This is cloudflare's primary product. It is why users use them.