> Not sure we should assume that the entire network between the browser and cloudflare is untrusted though.

The network is compromised. This is the fundamental assumption of networks. If you operate from this position you are much less likely to get burned.