Thanks. This is pushing the limits of my current understanding, but unless I’m mistaken, this reads like ‘anyone who chooses may hijack part of your domain at any time if you both use cloudflare’. Sounds crazy.

Sure, there’s alternatives: Aws, Google cloud and Azure all have their own cdns if you want to use those

It’s not that you’re wrong. It’s more that I don’t understand what you’re proposing as an alternative. To add to the comments here pointing out that that’s how CDNs work: for many designs of website, the CDN essentially is the website, being served from a cache by the provider. Even when this isn’t the case, you would normally have a load balancer in front of whatever was serving your website so that if you need to swap out the server for maintenance upgrade, etc. you don’t need to tell who your visitors to go to a different address. In that case, your certificate would be attached to load balancer rather than the server behind it.

If this was a 1990s and I were trying to run my own server on my own hardware in my bedroom, you might have a point, but please explain how you would implement an alternative in any meaningful way today.

If you follow the links, you’ll see that it’s essentially a new name for/ release of CBL-Mariner. from the GitHub readme:

CBL-Mariner is an internal Linux distribution for Microsoft’s cloud infrastructure and edge products and services.

I’d check that you’re actually installing the most appropriate package. For instance on Ubuntu there’s kid3 which is a MP3 tag application that will pull in the entire k desktop environment. Or you can install kid3-qt which packages its own version of those dependencies and doesn’t pull an entire desktop environment in if you’re using a non-kde environment.