Cloudflare has been offering SSH CA-based authentication for more than 2 years [1], I wrote a guide back in feb '23 [2]. The announcement is more about offering new features, such as more granular user control.
Image CDN primarily offers image resizing, especially useful for responsive images. It has a sizable market, both Cloudflare and AWS offer image processing service, see also major players like Cloudinary and Cloudimage.
Image and general CDNs are not exclusive: pictures resized on-the-fly and hosted on image CDN, while html/js/css hosted on general CDN.
If "orthodox" means "vpn traffic cannot be established through third-party cloud infrastructure", then tailscale and any other cloud-hosted ZTNA solutions wouldn't be accepted in that kind of enterprise.
SSH protocol does not protect against weak configuration, e.g. password authentication without brute force mitigation. Zero-trust can be misconfigured too, so it depends how well either of them is configured.
The manual mentions it includes EasyEUICC hash in an ARA-M slot, so it should work.
ARA-M does not apply to OpenEUICC; as a system app, it can work with any esim.
On Android, to unlock Keepass database secured with Yubikey, an alternative to Keepass2Android+ykdroid is KeePassDX[1] + Key Driver [2]. Both USB and NFC are supported.