Tenant custom nameservers, if created because of the tenant owner, are going to be available to all zones belonging to any account that is a component of your tenant. Via API only. In an effort to grant certificates to consumer origins, CloudFlare had to produce its have Certificate Authority. https://googlecloudinstall63182.spintheblog.com/27050593/the-roundcube-webmail-install-diaries