[tomklein]

Google now has a publicly available ACME-compatible CA. For CF’s Universal SSL (default/free) Cloudflare may use Google’s CA. But may choose other providers. For Advanced Certificate Manager (paid addon), you can choose Google or other CAs for Cloudflare.

But basically Google would be the one that is issuing an SSL cert for a website. Same as LetsEncrypt.

Disclaimer: CF employee