Cloudflare is fine for DNS hosting and the control panel is well made and easy to use compared to a lot of other services, they have no access to your traffic or anything unless you specifically use their proxy features.

Add the domain to cloudflare, change the nameservers in Bluehost, and you should be all set to use Letsencrypt via the API.

You could also transfer the domain to Cloudflare.