I understand it even though I also hate cloudflare, as ddos attacks are extremely difficult to thwart otherwise. But of course it stands that nothing in the code of any of the homeservers, apps, or protocol requires cloudflare.

Also you listed signal below as something you prefer, and they use cloudflare (and required phone numbers), and since its not self hostable, that’s mandatory.