I personally prefer that the private key for https remain local within my network. That ensures end-to-end privacy. That's not an option when using Cloudflare.
I do use Cloudflare for public sites that don't require a login. And I have the same zero trust services running locally for accessing non-public data. My reverse proxy authenticates/authorizes each request so that I don't need to use a VPN.