I moved a domain name over Cloudflare's registrar recently, and when inquiring whether I could change the nameservers to point to a third-party host, I was pointed towards a specific part of their Domain Registration Agreement:
6.1 Nameservers. Registrant agrees to use Cloudflare’s nameservers. REGISTRANT ACKNOWLEDGES AND AGREES THAT IT MAY NOT CHANGE THE NAMESERVERS ON THE REGISTRAR SERVICES, AND THAT IT MUST TRANSFER TO A THIRD PARTY REGISTRAR IF IT WISHES TO CHANGE NAMESERVERS.
3.2.1 As part of its registration of Registered Names in a gTLD, Registrar shall submit to, or shall place in the Registry Database operated by, the Registry Operator for the gTLD the following data elements:
184.108.40.206 The name of the Registered Name being registered; 220.127.116.11 The IP addresses of the primary nameserver and secondary nameserver(s) for the Registered Name; 18.104.22.168 The corresponding names of those nameservers; 22.214.171.124 Unless automatically generated by the registry system, the identity of the Registrar; 126.96.36.199 Unless automatically generated by the registry system, the expiration date of the registration; and 188.8.131.52 Any other data the Registry Operator requires be submitted to it.
The agreement between the Registry Operator of a gTLD and Registrar may, if approved by ICANN in writing, state alternative required data elements applicable to that gTLD, in which event, the alternative required data elements shall replace and supersede Subsections 184.108.40.206 through 220.127.116.11 stated above for all purposes under this Agreement but only with respect to that particular gTLD. When seeking approval for alternative required data elements, the data elements set forth in Subsections 18.104.22.168 through 22.214.171.124 should be considered suggested minimum requirements.
3.2.2 Within seven (7) days after receiving any updates from the Registered Name Holder to the data elements listed in Subsections 126.96.36.199, 188.8.131.52, and 184.108.40.206 for any Registered Name that Registrar sponsors, Registrar shall submit the updated data elements to, or shall place those elements in the Registry Database operated by, the relevant Registry Operator.
Cloudflare is clearly overriding section 3.2.2 of the latter, by making their users agree to 6.1 of the former. Can it do that?
EDIT: This question originally quoted an older version of the Registrar Accreditation Agreement. Cloudflare is a party to the 2013 Registrar Accreditation Agreement.