Regardless of whether or not you provide your own SSL certificates, cloudflare still uses their own between their servers and client browsers. So any SSL encrypted traffic is unencrypted at their end before being re-encrypted with your certificate. How can such an entity be trusted?
A certificate authority doesn’t have a copy of your private key, you send them a certificate signing request. The private key never leaves your system. That’s the whole point of public key encryption.
A root-CA can still swap out your certificates, but they do not have access to the private keys. What they can do is issue valid certs for domains not under their control (or the control of their users). With a bit of DNS poisioning you can now serve traffic through a Proxy and no one would notice (think: someone obtains a valid cert for google.com, sets the local DNS to resolve google.com to the IP of a server hosting a proxy and et voila, you can read all their encrypted traffic to google.com).
Isn’t this also what many companies do to monitor web-traffic from their network?
It is, but for a different issue.
Every CA you trust can create certificates for every site. If you trust the e.g. NSA CA, they can create a certificate for gmail.com and put a MITM between you and gmail.
The EU is planning to force browsers to add their backdoor CA