Thankfully, in this case the issue at hand is entirely unrelated to TLS, rogue CAs etc. Or even DNS record manipulation (for now)...
Cloudflare put a 'You're blocked' page, on the web server that Cloudflare are already running for their customer. The customer being the website that Cloudflare is being ordered to block (for users in certain countries).