Cloudflare is interesting because they do it even if you don't and have never used their proxy service, just their DNS hosting.

I was surprised when they issued certificates for my domains (as well as injecting a tonne of broad CAA records into my zone). You have to disable Universal SSL from the bottom of the Crypto tab. So, on second thought, I sympathize with you.