What is the proper way to route a static web app through cloudflare and maintain the binding on the SWA?

I am using static web apps and have found that there is an issue with using them and an external WAF such as cloudflare. When you route traffic via cname to cloudflare, the ssl cert on the domain can't renew, which is a minor issue as cloudflare works fine if the cert is expired on "Full" SSL/TLS mode.
However, Azure then removes the SWA binding entirely after some time. Which breaks everything. Removing and re-adding the binding every 6 months is also not a real option.

I would use txt record domain validation if it was possible to have a txt record and a cname at the same time, or I would use file based domain validation if that were a supported and documented option.

Static web apps don't let us use app service certificates which would be the ideal way to solve this problem. So what can be done to set the binding, with a valid, or invalid cert, and allow the binding to persist while traffic is being routed through cloudflare and back to the service?