FA has their old SSL cert from June back in place so it's probably them but dang it does kind of suck that you can't actually tell if you're talking to the real backend or not because Cloudflare MITMs everything

@kauko At what point does Cloudflare itself become a security risk?