Comment by fideloper

they also provide certs for mTLS between cloudflare and your origin, which you can layer in along with IP restrictions

(the term they use is “authenticated origin pull”)